Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
11/10/2024, 22:12
Static task
static1
General
-
Target
1ebce88fd9ed81307999d103ecfc34c2b496aaea197b6cb3be9d3f0c58923000.apk
-
Size
4.3MB
-
MD5
1382eb0d9cce4223566c43d6fd5d819f
-
SHA1
a66e58e07af419cf02ea48b89be1fa94b9365747
-
SHA256
1ebce88fd9ed81307999d103ecfc34c2b496aaea197b6cb3be9d3f0c58923000
-
SHA512
9ff49d1952258fb1a01b6ac9cf22e5b3e7d986d5b226863dd4f80b3456b8034ee127e1d717dbb719930565408deea28e9ddc60d07e0769159ade30d8e3c7eb25
-
SSDEEP
98304:GP9xxsnMx8UDAVJGXfgQ+oQVpcjRUoxrn6wQn7g0dTeEkC1/4bE2VWrcynAXJTdx:Nne8UCGoQ+oUqlUcf+7GEkCIEMWhAXx
Malware Config
Signatures
-
Android SoumniBot payload 2 IoCs
resource yara_rule behavioral1/files/fstream-1.dat family_soumnibot behavioral1/memory/4272-1.dex family_soumnibot -
SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/gzroi.klwx.exv/app_dex/classes.dex 4272 gzroi.klwx.exv /data/user/0/gzroi.klwx.exv/app_dex/classes.dex 4300 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gzroi.klwx.exv/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gzroi.klwx.exv/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/gzroi.klwx.exv/app_dex/classes.dex 4272 gzroi.klwx.exv -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock gzroi.klwx.exv -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo gzroi.klwx.exv -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS gzroi.klwx.exv
Processes
-
gzroi.klwx.exv1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4272 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gzroi.klwx.exv/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gzroi.klwx.exv/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4300
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.0MB
MD50674b87591e30c90a15ed045d355f673
SHA1fbddd5493bcd9929320e75acf9e437425980003e
SHA256f3e1ee78f1fe42dc84be8634e66efad6e317d3eccc996f873ec97001151f78ae
SHA51235e1ee4661ce56b9e6fbb902518bce756d4a2ba5f748d4524987d25748cf005ffee92d00e33e8c5b44477d47699871ac2842ba05131c113d618b89f7460e586d
-
/data/data/gzroi.klwx.exv/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp
Filesize166KB
MD5f75aaa920b08fa0e17bc524bcddc3747
SHA108b960b03fc9c3373940da5ed8ba8955f367c8de
SHA25600af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657
SHA512c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371
-
Filesize
180B
MD516a32559ff60385966e73769320fc47a
SHA199dc629f36569817bcef80abdea8d21ff876d14b
SHA2564e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96
SHA5121b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
90B
MD505f1176bc25a32f52c20a6902d7a3f83
SHA1a05bbd36b905727c544ffea6d8309a753109e2d3
SHA25664c54a6812aca24c18256a931405a53b9040f715b11f46fa151fba66afc4ca65
SHA512a869a70fcd314ae6c174c58932a012c9f57254135d20dbc4c24d6332495553a362547075e8bce5b4ab73246699c83605fc99c551121ddc8bc2e715b31cf34e7c
-
Filesize
569B
MD5b7e5697369499b8b3621216811cec48e
SHA13bfccadc48632bb2e08a4029d316f2d72fe6e5c8
SHA2566811b7fb32ad46fb3a2b234f3f645fbd0fafd44b2c0d3b9a70f41a2d2d26e953
SHA5123b8e638c302158de375873fc1016e5f506e4d386fa26b21d1734d764e4dbd3f05384b5dcb706ff9a940a1dfd5c785ef8de28edf2fbf97e45cfd07960b068438e
-
Filesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5668576ba077572c63647f6290e220bcb
SHA12bb97c5a4d503dc7cd45b831da88dfa1cdf5387b
SHA25632397f61b242e7dabe6356b287c19c07bbf56b0edd124340be8d6bce1413a096
SHA51263d792ee1cdd6b5fb29491c817d65a6ad8706b34e11a3ce3f04c208f5c0046edd43e3a8046e87b9fe941effdce085c51814540c9940e1be31fa2ed328b72114c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5053018447986a678f1ebf5f45a0dc3d6
SHA155a92023bc8b3c452da45b497d09ac3329277b63
SHA2561adda12770b77951d21af73819020b39a89b53d933f42a3d9230f9e4f3eece9c
SHA5127da8c248b1fdde764d9469ebdad7193be767a08a3f81c4162123faac90883a751887081f968c57fcf360f65970e922bfc01c373f65d8fab8f2413ec2926416ea
-
Filesize
112KB
MD5731ed73b217d12b7ef26ff25926432b2
SHA112ce3136c784a38b604a6c336be6b925855d9510
SHA256ab620f80d2b8de5a0672c18f700cbfb53fad5011e85783ce1d4378e84de358ee
SHA512f635bd7e66fb8fda3c35fb2edc548eacbb82ec1524c00d501def33effeb8cc784579fdc975ea33053d50c2faf68f1a26c2d6b594520ec2738e4f55dc575056f7
-
Filesize
120KB
MD5a330c8751093a442e87af04e353d4119
SHA1835d03a77271276e4517be21d777eb841112775b
SHA256518c71aa25b032226eb389f1576b979a1005ed5e703948396d4aa05c3fef0dcd
SHA5123dbc64475b1452289ab70dd558180a7fc626537caf6e52c2bc4e99d921e106d7ea71f97c76cd22bc334c718f04c601fde856bc1ed25c01533b5870148abd8a7f
-
Filesize
7.0MB
MD520b29cb573ded8b6a13c639458d1a783
SHA13fc176711d8d93d7c8426d29b8bb0656d5210e10
SHA256eaa5f5643c65baa3aa0ec2eb168def2d11a9178458d45b2551422419437030f8
SHA51255988383a8b37b36b71e82e8c588f6ae58a1a85d530bded145c68ddac440775b2673629a1ae98467a567858dabe2e8094c67cf9ca81cecadc6d7c20157dbe027