soumnibot | 5f8943e99a296799728bbc11b7e3aeb91691f19e1e5e04151f526ba134ae271d

Analysis

max time kernel
149s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-10-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f8943e99a296799728bbc11b7e3aeb91691f19e1e5e04151f526ba134ae271d.apk
Size

4.2MB
MD5

464b62b1ac6bd1bab8ff2e369fc12baf
SHA1

36a8ad5ead83ac3a99346c2286506d98f5c42635
SHA256

5f8943e99a296799728bbc11b7e3aeb91691f19e1e5e04151f526ba134ae271d
SHA512

8d1a8536b39a33d8c94bc5eb493996b9cc4ed041e7f42f056147c319cf05519cdf8498ea196427daba53d7c65a4583f2b14a6ffa483390707df68ebea5b43de7
SSDEEP

98304:Q9zxAfx8uDAV7ekHWsGAtTbSfCsZ970K4Ow5GPU3+1Jd9QH:1J8uaek2sG6Gq42mv1T9QH

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4244-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex	4244	jvr.dqvyuk.mabsh
/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/jvr.dqvyuk.mabsh/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex	4244	jvr.dqvyuk.mabsh

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	jvr.dqvyuk.mabsh

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	jvr.dqvyuk.mabsh

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	jvr.dqvyuk.mabsh

jvr.dqvyuk.mabsh
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4244
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/jvr.dqvyuk.mabsh/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jvr.dqvyuk.mabsh/app_dex/classes.dex

Filesize
6.8MB

MD5
152a9e47b350e7f8c78a92aec1c3a071

SHA1
5e04c0db6d4b33b964ebe773336b4fca70092336

SHA256
b1312af763ff729c7be2830a5b3764aeb19a1a175a26555e5e384b3b0860ea4c

SHA512
2e1ca1c93c7f1a0d148d663327a9a8e762e0b2d795c968084384d4e83aadff3db9a9c4628d2c724ff8955ccd7a56eb3027fe66b76fbef21fe3d84db192fc2c91

Download Submit
/data/data/jvr.dqvyuk.mabsh/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/jvr.dqvyuk.mabsh/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/jvr.dqvyuk.mabsh/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/jvr.dqvyuk.mabsh/files/PersistedInstallation5798148775560660597tmp

Filesize
90B

MD5
29f6d0f1b513548d74c41f627e363d57

SHA1
7846dbace6b72db652ac2b28c98df22344c630bc

SHA256
afba02fb44cbc7cf5a1890aab201db7778b1ed398fe36977f8097942d04c2759

SHA512
b6210e902f130bc22dd0a56e0f73fea606c55908531a01a91d76cfbd5028393eabd2c6fff09aef12ea918478baf0a10a130a25fe4fea8b1cff19b355442c6f75

Download Submit
/data/data/jvr.dqvyuk.mabsh/files/PersistedInstallation8300898336714103797tmp

Filesize
569B

MD5
a010a1ee62880a40ee1a3755dcc54032

SHA1
86ab19f63f6b0b4b061bce1505f9ef0b543cedf4

SHA256
42f3c55a270015b193ba06eb33b9f3e562d73bf7728f3007cdfadb42ed5fa2c9

SHA512
4c9f7637d8150427dff9980154a9252ece4cbda8d94c6e1aa0d5fe2585d64331bc0791ba4e16cb440cc66df22491bf0a9ba8ed49aa19f66ee662f6fd426f1306

Download Submit
/data/data/jvr.dqvyuk.mabsh/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
179846f14682b124df323ddd6a971193

SHA1
18561971257d44de458bff2c305662b442473c3b

SHA256
e5493e03aec5398abed27dbb8ffbf1b955a562bf1e886dfc1bd63c37956b087f

SHA512
ae6a5d194bf6387718112e8ceedd90760824455d604d4d6d76dfcb435c08ee4019b8e3be9cd788d87b1e4e0ea24462836da1afd54e672ec0c40b5d2656e06569

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
50e5fa4b64268d054bd5b3462d26662a

SHA1
791f04665971569d2bd8160cd9f0f9d4fe8d0b6e

SHA256
a6983947437086a418d2ca124f7df8c269c4ffc826787f53cd3eb121375d396b

SHA512
bc98a73b2abb9e121ec11d09a9b15c33c5d644b0fbab5c76582b18840bf19fad811959e89b0298e94c45659d92f826182a2320208db6f1f81e13a739555eeca5

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
a8727ed7b27da6ab3d4555ce5088b8ec

SHA1
217018da65549ffecc307e00b09b700cd1cc775a

SHA256
9417da6337b39de599bb80175405923f750cfee7a3610b64acc03495384e7917

SHA512
1f49ba3e677d0498408c482c2318d114014ae015c039ed7e36058cea106e99cd161dbfd2add595292424b14af667b06d649a590f8be617f2b9ab6a71cd55b9ed

Download Submit
/data/data/jvr.dqvyuk.mabsh/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
bd6d905ca881dfd29ed972f22802bcea

SHA1
60ac2adad976a15068d44b5c3e419a02c616e0b7

SHA256
925e81df25f2af6ad06d4730737b5a24a2da44f5dc5fc2809225ede53cbb80eb

SHA512
9e396fb1e147b50b4973524a7412ff6e196dd61043ec021f1950e9ceb05ed2996b60d860e0f9ae403e32205d8f85c0a4a8ec5bf3940ebf3f13143e0e3a2e6559

Download Submit
/data/user/0/jvr.dqvyuk.mabsh/app_dex/classes.dex

Filesize
6.8MB

MD5
72663bde5e2b0399eac814f0d5bee919

SHA1
19b3aabfec33a69278883a290372678488fbab29

SHA256
975139ac0f96ef9286b0053e84f92e55023dafd4ef7339e1f388e14b0248b360

SHA512
e9e948c2c0e857c5498d290c0d0c16ed3d8276499064b027ecf1d2a1b4e09152abb5ec1cde54c380c731141b520df3809bc18e1c699376cd610f9baeb801c7ef

Download Submit