soumnibot | a9632891f4aaebcb9f3a3abed8d9791e933f51c7fa83e3a1e61608c56c0f7a79

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
11-10-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9632891f4aaebcb9f3a3abed8d9791e933f51c7fa83e3a1e61608c56c0f7a79.apk
Size

4.3MB
MD5

7707457457be2800d3d43cad46b829f1
SHA1

6118aa37a88e73e47f85a7eebba25bb7c48a22e1
SHA256

a9632891f4aaebcb9f3a3abed8d9791e933f51c7fa83e3a1e61608c56c0f7a79
SHA512

988e398aef7d67097b9f4fc71c7a7f5e96e8dffd7c167afb21d53317f8fe5a04fb84704369860c8e4853cf8e09de79a634abfa5a93f975fe9beeec2acd63a79f
SSDEEP

98304:j9UxE1x8BDAVwzH4rzEcjkoZTbV15DwfJ/9RMEuQkaXBJSgEHds/:rH8BtzH4HF/ZTtwh/kEuQFXmgUs/

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/xdu.pbtp.ntakc/app_dex/classes.dex	4285	xdu.pbtp.ntakc
/data/user/0/xdu.pbtp.ntakc/app_dex/classes.dex	4285	xdu.pbtp.ntakc

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xdu.pbtp.ntakc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	xdu.pbtp.ntakc

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	xdu.pbtp.ntakc

xdu.pbtp.ntakc
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/xdu.pbtp.ntakc/app_dex/classes.dex

Filesize
7.0MB

MD5
8194099f01451c9c446d2e778693e6de

SHA1
d1c554e16462eade1a9a85c1f60faee8f5f76b42

SHA256
3bafcd5ed9e97688826719c833a23e671c8a30b6068376f9a05f087b65cfe2c5

SHA512
75824efa6468f5569a212d9acb25717f031e5213a05a251d8f77d23ce1aa90c5d2af657fd3040bc3fc45b13993b0a9dd95761464d408a7b33a8f6ee483ff0b03

Download Submit
/data/data/xdu.pbtp.ntakc/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/xdu.pbtp.ntakc/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/xdu.pbtp.ntakc/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/xdu.pbtp.ntakc/files/PersistedInstallation4540389724226204318tmp

Filesize
568B

MD5
bae74485f1c215590f5d0c62136a9f50

SHA1
993a28f493944835632c80ff6fad15aea85c2d6c

SHA256
31fa2d2b0c65279c05f9246b9a486c34cabb59bfebb011e36b284dff61a03c8b

SHA512
a642103ca2f1f28a2cff405a2d2561cf53fb96d9761412b8033892c9a8648bccc3d4f5d54feaa0ad73ffcaff53c0647b1c865d4d2e50e78c46a9f8eb566222ca

Download Submit
/data/data/xdu.pbtp.ntakc/files/PersistedInstallation4724034212269574811tmp

Filesize
90B

MD5
fa2b6432fe66149f3ad5a71a1044a042

SHA1
a970fcfbd78209a6a8ad1794a968292e752b4d6e

SHA256
0af6ed232c3b56f7299b0f88ea50e4e6e2f620fc159ec5d97ae4b5c575dba339

SHA512
1bd72ecb035fd7e1c3a07d1ef1b9b2228c378ff05159a1de6bd6cc714e028c81abb98455edea533d0728eb4277e801341f91b0ec28f1b74951587fa57cf3284c

Download Submit
/data/data/xdu.pbtp.ntakc/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
f151078b4cd7a78c92c691823a438a9d

SHA1
e9555ef7699851ef3936fed8470cc6b12637fb4d

SHA256
4a12836d902deebd5c422b4d5f8f5d0b1c2929533201e65f5547ae5bd6f1d269

SHA512
21bd8f4a35d20cd998388a6676583be2d0ac40ad60203053e5bf2dd0b82db402638daf5bf6fa55b7858f8899ea30a332b0c10b6c7829745234d23c71b27bece8

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ebafccadf985088f427fb9c83db75aef

SHA1
e68fcc01f0e19094afc2005b19337b301aabf4b8

SHA256
eb7527bb82d4db14fb1e6b5212a2d5f12b0cc7c8e84b3f5b3f65fe7cb20b061d

SHA512
822cad27a3dfcc773718faf77170f32e80ecac2f549b2c1d01ed9ccbcc30e1576448c854c864450d1a9f23f901cec4736807b4e8a33b2277963f4bae80ac8a6a

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
c66e573bf5342dda09eb4aa13963d742

SHA1
19a5ca6eaf4a14e5f9f1ab9107aa1badc4c33d2c

SHA256
79ef85340eae4d3bab27aa440c80cc534ee91b75d3a522e24eb94c685f6c478a

SHA512
cadc9a99ea9ab058ad23e3e5e13e86284e30f9bee57e7273e0438d1739b5f9959f87864430899e23b1678b680574c26d7c9782cbaa4951b61f9045ae06d6b9c4

Download Submit
/data/data/xdu.pbtp.ntakc/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
3077b8d76e8baa425d09564b32443523

SHA1
08847718b3b9dbce9c39d59659ec05208c7517e1

SHA256
16b635338b67b1fcbb08dc0f5e2d1354a3a03e65cb6028f61ee34631f248c9ba

SHA512
242071b8d0af668336717a4db939eda72cf57017096f257984ae50af69508c3fb373f0bac0e3b9f7fc190cd5aef2282a679b522dff418f95ebd8597b1d4d66c6

Download Submit