soumnibot | 72099d34d441dedd77f44d9bd29ff167f44e2922df740ac8d97805e5787238b8

Analysis

max time kernel
179s
max time network
167s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
16-08-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72099d34d441dedd77f44d9bd29ff167f44e2922df740ac8d97805e5787238b8.apk
Size

4.9MB
MD5

03f0780ca4e352b7b8729108d15e8e3c
SHA1

327d1ef69f8ad21a312d6ec2969546f3435cfc4e
SHA256

72099d34d441dedd77f44d9bd29ff167f44e2922df740ac8d97805e5787238b8
SHA512

c9763b3431a630633fe9bf596cc6cb6efeeab9433c3474e3582b03293afb1cbd3bf8879f9154e5f438f75a6382ae95d6b0ae2988f22719fcfce01c2348d99a6d
SSDEEP

98304:L9xxd8x8sDAVYoV0S747tFTIKCerELJXNqwy+otE850QLprqhGvhdc:3u8sToV5KCfLRN9yXuy0Srtc

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4252-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex	4252	gmlt.sfbb.ykwtgl
/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gmlt.sfbb.ykwtgl/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex	4252	gmlt.sfbb.ykwtgl

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	gmlt.sfbb.ykwtgl

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	gmlt.sfbb.ykwtgl

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	gmlt.sfbb.ykwtgl

gmlt.sfbb.ykwtgl
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4252
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gmlt.sfbb.ykwtgl/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/gmlt.sfbb.ykwtgl/app_dex/classes.dex

Filesize
8.2MB

MD5
eccc93ce43981690772b1707cb50cbdb

SHA1
a72a2270223312a1a38e08bc2826fba30c2ee77a

SHA256
ebd5884fb640836bef3fdcd49f951f2cfd2f4ad153bfd9b34cada13a126573e6

SHA512
46c59f9c85a3105575bec2fc6cd3f0a9c9dcc9dbe280111b1d511a5fdbe55a3589efafa541c89292dc6a32280cefcaa90bd62143f50031d7bb3b4174c8c2eb93

Download Submit
/data/data/gmlt.sfbb.ykwtgl/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/gmlt.sfbb.ykwtgl/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/gmlt.sfbb.ykwtgl/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/gmlt.sfbb.ykwtgl/files/PersistedInstallation2728524822687873051tmp

Filesize
90B

MD5
3d2abd70e03bf5a5a6bbad02ab4363e1

SHA1
ebd8a78a94cce167961f9aad6e075d0f4fa8b0eb

SHA256
352d15b1b501ec79728849cf27f4f34ef6d5e45242b8c9ba5d0f324c6897b74c

SHA512
235851501cbfb266ebd1cbac1e61a895d7b604b6769e08b5c8111bbd3831e490bb531a9bf02282b4931e1c847a600294f90f75d14dfeb6ff10fb5a4e590b8147

Download Submit
/data/data/gmlt.sfbb.ykwtgl/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d21881d5e2b220bc16644415544e512a

SHA1
3f8bf05ba9617c494e79ff55a26e39d1a1586e9a

SHA256
c46a7a05102bc1b304eb5d751027c4b54ea8f43601b57dcde1e858d55f4e625f

SHA512
db7867904dd6895355c285c546f2a9c3868e0537311d813aba9c2ad5975a5eea75bde4247136b3a5ff22ba717bde3001029feafdd233102734a555efb73f7453

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1686bef57e98e841c03a66e5ac72d9f4

SHA1
b80818619b2d2507703bb57c9b567ff1cffd4098

SHA256
5e28780185e0227491bb5c099703a1b730fe793454c4ec57720642bcc1b4c29c

SHA512
4c13a354a9379507b0154b91cfc80475da83eece5e6757bbf433c6bb923c7def597d0ebbaab6e9ef70bf5a162cfc37eeb23e1a3cc580f9815d819bdcc8e5d8fc

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
5c9c6b77c1fcee826b0f78f18455838a

SHA1
73fbb3f0a182a5ecb585191efe5c13cf5a8e4552

SHA256
8bc196cf82a35e37a92e99fe9ccefa1b240579ae7f7f67186e54added5bb4e4c

SHA512
5864b90558a5a97f3b801736bb0660b42c07481791ae284543b70f4216e9cb61f544dc79023e3bee805b773bf4ebf087d4bfbba5708fce844663e5f0da415360

Download Submit
/data/data/gmlt.sfbb.ykwtgl/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
156f06a755ee6bc549e108d405890691

SHA1
f1c8f8f96d8487e8c053e8fb986fcd01e7abd2fb

SHA256
12c7c6eef0c7243cc51335cd3b6b6453225184eff44f06c78aad263dc1ef089d

SHA512
da31f8b52c3d3d9a99d21b6eeeb8a4528222ac7c4d425bad48c8bd041111178cb931975b779d6420f95906a632cc31a9b78ed9ae4ed865e5e14f3fa3de01e5c4

Download Submit
/data/user/0/gmlt.sfbb.ykwtgl/app_dex/classes.dex

Filesize
8.2MB

MD5
2a25c42467956e2fdf262859fe9005d3

SHA1
eb39a60a4a9045773dd48e4d2a4d59fc1273540e

SHA256
1a6249552db0f59723a8a1396b86f17e79ed875f3fc5338784e41410b5ed8d6e

SHA512
e5208a4d4cd9cfe962d32b445ca84d91d36cc247b29f2d3bf38ed507f416f1e68738b7abe169e1c54cdc96df99f188dde4541b3f323c974a9de13c8ae2a6be3b

Download Submit