soumnibot | 4071e34ff06960e5ab4c5b8ed926c326e42c93fdabb53873339f9070606c9f01

Analysis

max time kernel
149s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-10-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4071e34ff06960e5ab4c5b8ed926c326e42c93fdabb53873339f9070606c9f01.apk
Size

4.3MB
MD5

68106ad6b4a0c1417d2458027ed674f8
SHA1

6e21c3a25ffd0d5d4a40da8d1aab1efd3704b84b
SHA256

4071e34ff06960e5ab4c5b8ed926c326e42c93fdabb53873339f9070606c9f01
SHA512

2cf012e599b9c766a2cfe2c1bc0bf2335027f8850fb85ba5fb96eefed84f8947effa8a02915267525de48a310c670126621b5d0cb29ce6aedc61d3294847b6aa
SSDEEP

98304:lT9xxT5Rx8yDAVVrg7jGYM8UgpVdQnMEWYJcTJfzHbrgwcagUKtk3FuGYDsxdM+:rh8yQrWjGYM3iyMiwJfTHgvYwG5M+

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4257-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex	4257	ej.ssvcp.ucnm
/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ej.ssvcp.ucnm/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex	4257	ej.ssvcp.ucnm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ej.ssvcp.ucnm

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ej.ssvcp.ucnm

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	ej.ssvcp.ucnm

ej.ssvcp.ucnm
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4257
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ej.ssvcp.ucnm/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ej.ssvcp.ucnm/app_dex/classes.dex

Filesize
7.0MB

MD5
fad8e647be3a00fe7b1ddee4e45c43d0

SHA1
2fb3b9ac99ecfd317e645e6dabb40ae919e28dac

SHA256
9093c1eeed6fe25dc9c1ef94e514e2795a659f64c12198df725204a71a68456c

SHA512
bab39aff31566cde54da7e473c9fe6340dbca6d97cd3cd49efd88248f490c4675422be060547ea9f11177b660429cd04367cc67e03795844ff9f99f18c3985f4

Download Submit
/data/data/ej.ssvcp.ucnm/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/ej.ssvcp.ucnm/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/ej.ssvcp.ucnm/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/ej.ssvcp.ucnm/files/PersistedInstallation8185285665311516772tmp

Filesize
567B

MD5
905cc47d995d5fe7ec4b1a31d53db071

SHA1
8868447a55f6e276b226421a8217fc95793c9d1e

SHA256
1bf6847f83412d3ccaa9d2762471e747829e2788d3965678f100b7219073dad3

SHA512
1cad458f31fd737dd4b6ec4d8ba58dcec71b6af195541eebbbf9751c89d155a19fc823e00f6c91ab000a9591c9d46be422ce453f5647bec2f9fbdd0029fb993e

Download Submit
/data/data/ej.ssvcp.ucnm/files/PersistedInstallation8779098170196134666tmp

Filesize
90B

MD5
a470a1ba943a6bef75de7119dc7b1c52

SHA1
2f58c0100fd0a3a9be30b805ddb24cb03c50a109

SHA256
9083a13883cfc7f818e1ddf0f2286080dd855912ae1d50785528970be423ec41

SHA512
d28e4a7ffb168ebf34f58c33ed79133d43cab94df4bd013f5f43328756a284b73af4d53d1a6225ccbf4b8408f6e3764573f34aafed935b1f6ec05071efc56252

Download Submit
/data/data/ej.ssvcp.ucnm/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
1e31f7412edc6dce54e0d498270be4cb

SHA1
996c85fab82a981d66ccf4df620b47c4672a61cc

SHA256
8694bf1d0d0ef0115acc514fbdfd2c83bb472920f12ee86c25ed2d8bcc77d4bf

SHA512
bca5f193bf5068976daddbb528d7017bba8cd4e3db15ab82577594001b365afb2efd85486980455ba47ae1efb010456fd0831f54a84bfd69a1a29cfa57162914

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f65ed6c802ad0a1231c2d582a25d0f71

SHA1
1b4abf24f614c5b4363de49720b69893489fb4a1

SHA256
1dcf9bdff744bf59f9491e2575856799ea275aa9010bceca3bf016e3cb046d17

SHA512
9a73a4b8d831211dd497bcac56fa803998797ae4fb7256c50fc742f2d5e3e93b0ef2765552cca5ff8f462450d8037d465e56b28763eb0484a427a3538ef14ba9

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
143a7c79b12574b06c0ced4f542321e7

SHA1
ba9fa221a0f57b2d8947bd71c7e8dd866b20410e

SHA256
ecce59458f38115ac8e41194ea4674196dd8ee80de20f525fdc876741804cb04

SHA512
f3c6ffc290ca0f7d0ff72357d14e33ae40da18c13a88cb8eb784f0c99c4c51415427864d2e1e7404b7a6777a86e5796c0cb51c7988743f069880bc6a7fe97032

Download Submit
/data/data/ej.ssvcp.ucnm/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
1fcd703e0d21e91f67aea6973a143dda

SHA1
28a11fb962dce9c2d26741b6c65a5b21431fd312

SHA256
f525602fde8d3af0bee77c0e39499c311eee5d56cf3de81376b7a695a839b81c

SHA512
1c818ab4b8547735dca6195a5dd13356fc3a99552e6c1f445b37bbfadeed1f994097e3b266267ba5bad9c9435d94006e5a6131a92517193b750d4c051718700d

Download Submit
/data/user/0/ej.ssvcp.ucnm/app_dex/classes.dex

Filesize
7.0MB

MD5
69783be3913a6e34cd183c026abee149

SHA1
44fc7038622cc1de359079e7fe072dddca402bcd

SHA256
2cf4f35fdbed09d5b9596276add9499668d2961f936327936cb798787d69804b

SHA512
95082e72ee63c50f5703dc9334252ffc92963d6265baf7727e57875ff7ad6166c10b37690b344f830623788a58bb1bb4b8d24ba3f6735bada1f864a74166c162

Download Submit