soumnibot | 0954a38bb087f784567de05bdbb53da1fc7777bfde96f512446d662e855bc9f1

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
07-09-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0954a38bb087f784567de05bdbb53da1fc7777bfde96f512446d662e855bc9f1.apk
Size

3.5MB
MD5

1c05d39828fe2fd4d5feb84564759276
SHA1

7048d554b6a0c46a5e2dadb1711426cc93dbf9af
SHA256

0954a38bb087f784567de05bdbb53da1fc7777bfde96f512446d662e855bc9f1
SHA512

720f11c0a90b90ebda40bd08cfaf1733ccef4b6a5fc8976ae115307e58699ca94ad72c52d1730d37d31fd5a83ea7b1d63feb56c62b6c3ef75c232cfc1be18531
SSDEEP

98304:aZxLZQVjr57+ZvNqUiFZkXwYu0NpLyRgXjeyhhwmOz/6FEj1V:EtZQPyNqUnu0SAxhmnhV

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4273-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex	4273	bznlvk.xx.fohogk
/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex	4301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/bznlvk.xx.fohogk/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex	4273	bznlvk.xx.fohogk

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	bznlvk.xx.fohogk

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	bznlvk.xx.fohogk

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	bznlvk.xx.fohogk

bznlvk.xx.fohogk
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4273
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/bznlvk.xx.fohogk/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/bznlvk.xx.fohogk/app_dex/classes.dex

Filesize
5.7MB

MD5
995870d722fd0ceb7c14c8d93bcbed39

SHA1
ba414ec2cbad13fbb3db58a0ee50c6ba3998554d

SHA256
36ce93f2666f15da00b157065f78368fd1dcd17768dc3d23bea0172f7f220128

SHA512
398d03150443cd03db97ac1fb36856dc9fa23c91d1ae07df8eb1b30c798004652a593ebf03cbb11fe87920fefaccb3bc73b2dcc3635c82e5cb81df1a696d93a3

Download Submit
/data/data/bznlvk.xx.fohogk/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/bznlvk.xx.fohogk/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
be4b5b769dad4b9bad59769bb4f8c5ff

SHA1
7b52383e19b558c466d668f2252344250cf5fb7c

SHA256
6eb7f487697594bdc7af1152945826519a1b4bc907dd3d1fd3fc0d2f54f036aa

SHA512
bbd843fe139ed59582326a18b6dcd5523015ded764eac90e7352d5de5a190dfb3ab3b097a6947e1f4a8e15c382d4736d21cad46c6f5bfc8c62b59e62ddd6a79a

Download Submit
/data/data/bznlvk.xx.fohogk/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/bznlvk.xx.fohogk/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
3c754dc1c9fd564d962ba35fd424d6b3

SHA1
57d0f71d79aea4e1ea503f489cfa9ca037df8805

SHA256
c63c19681aed3b87f413740a9aaf1547c257da7947ee1c09ad453632fd127703

SHA512
3b4158959a871eaa6b5317b999b5a03f47703d6ad1899d98dbac1372dfb49bc28ecd9cd453f40e78b33efdcd03b8c73379e79dda1854f3ad505c113942830df6

Download Submit
/data/data/bznlvk.xx.fohogk/files/PersistedInstallation2552889599003876467tmp

Filesize
90B

MD5
66ec328b3f088eaa42acedd6e36eaa32

SHA1
b7a68280f2326299de14ed433a990fe693986a6c

SHA256
9296619e40ebcfb320cfd2b771de6f1695588db053496b06393566aeb602be91

SHA512
2d3b3dd773eda43fbae7ed4c9d90b1fb91ad2865a588fd2ebdb9b0bf595366dc272fb74b841a67a18e5d5f203bcafb65c8c60277d1937b93fad15f32f8ec8fab

Download Submit
/data/data/bznlvk.xx.fohogk/files/PersistedInstallation4288103903613595837tmp

Filesize
567B

MD5
56a6e96ce9f463577134f722740dfdce

SHA1
94cc0b2504b1047849354560b44be458bc504fed

SHA256
f6bf57d89cf0c4e926fd62fae6d82af961737124817d7a2b6c8cdfed856dfd6b

SHA512
8c5a9379cf1758750632ec2cedfc581ff506c5bd9c72dec678c6afd446b064911a00dd2182bd4e9268e49124be8ccdbaf9e0bb3cc8d6fb71bdab25232ab81d37

Download Submit
/data/data/bznlvk.xx.fohogk/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/bznlvk.xx.fohogk/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
123e9b37777ee015189821d61c5425a8

SHA1
2aa61fc201f1d0423a575b910a4218efd2f99032

SHA256
037883bf871c9c28ce4af276ea5e9fc93d783822502e07802536f5608bd876e7

SHA512
bc4a3cf360dc2d0e8905860b3d621c8a6d8bfbc18107427b75b8701f13f315deeef1aeee3d4b444f5f38ed945b0928bd87e3785852058f1b7d3aa60586ec9f67

Download Submit
/data/data/bznlvk.xx.fohogk/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5b8118d0ee6e5dd0f9df2461f0a2f056

SHA1
1b7d55f912b3be797532905078edfc187d41809f

SHA256
3e17e7459d6ccabb67470d8dcd8afa990c6eb614c11ebf7a8276242859094e68

SHA512
ee0e170fafca852c91b15ce910b3986e57a8ccbf7d74bbac43ae862e8e3ca232f5fe651fbcc77c4cf1c2502aded2fcce6b1b0111a192006bfb93a984f2ff21bc

Download Submit
/data/data/bznlvk.xx.fohogk/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
eb2c8b27451870bd476c4757d81ec45f

SHA1
9466b3af7723e74afb84793b3bca56b43b85ceb5

SHA256
54431a67c336187cfa75492aa52048e34e86a58be6cc0e9694e4a90b46100c54

SHA512
a8c2c0d81a143ee6b433eddf437f70ee60a1c3bd154137ba7aea8868a35ae5cdd4d40d4b945f3ec6c4f902e859aa948f0462f21bcbc40fdb62689b2392354f75

Download Submit
/data/data/bznlvk.xx.fohogk/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
c337f5073cfcdac163ca670ee4ede908

SHA1
d169e5289678b1f8756fb22633c44f4724970ee6

SHA256
5c8449352b76cc87b89266bc6a496cb251434c4dd070712cb068aa18ebbde629

SHA512
e14e5750db879b1cdbb16361a7bf86ba3e12494bf7335deb00812635a16b84a853f88c02f6f67adb3932e8a01c38ae386aeb7cd25e81bb09f59d2359aa51d668

Download Submit
/data/user/0/bznlvk.xx.fohogk/app_dex/classes.dex

Filesize
5.7MB

MD5
c50666baee2dc181190232686c86f1d8

SHA1
a5a16ff972220099b9eb9c6b6cd2e84809079a65

SHA256
91b419cd667545297bcf41f03dabfd7e8cda9f2e06dc8b7b9cf7b54f28b92e1b

SHA512
f47381023ef33c719b8a3a76af03397926e428bf79905d9e1e6ddfc443540380f00e59a867be8dc24af9368749d8ff893969b8a2086d2ff4624ba55bc7ac633a

Download Submit