soumnibot | 55f55a3e96d958657ae8cac226297febb4cb9bc52d5890fd79784e857d71dc68

Analysis

max time kernel
148s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11/10/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55f55a3e96d958657ae8cac226297febb4cb9bc52d5890fd79784e857d71dc68.apk
Size

4.3MB
MD5

228aa69cbe07aba41ccf751e554d6ff2
SHA1

2b2239241435ca52d4cde535e0b752f5637dbaf8
SHA256

55f55a3e96d958657ae8cac226297febb4cb9bc52d5890fd79784e857d71dc68
SHA512

945f9604e426fd40b40089ea6279e0d133bc51054c2bf9a2f5d965a7cec0649ec975ab6fefefc2a3dfab58336f4a31f8e73323e89ed48283dabec681d986bbc5
SSDEEP

98304:F9SxDex85DAVismrkOuu65ayklyd60d/0ypft/EVrm4iCd3:Y4857smrkj6lys40ypfhE33

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4255-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex	4255	xbz.mcnqy.yoynz
/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex	4284	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/xbz.mcnqy.yoynz/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex	4255	xbz.mcnqy.yoynz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xbz.mcnqy.yoynz

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	xbz.mcnqy.yoynz

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	xbz.mcnqy.yoynz

xbz.mcnqy.yoynz
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4255
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/xbz.mcnqy.yoynz/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/xbz.mcnqy.yoynz/app_dex/classes.dex

Filesize
7.0MB

MD5
60d09dd153a49698372b6106d1713498

SHA1
a73462e21b6fd5cbbdaebc02690405855bad62af

SHA256
e9c5ee46e0c1758847a06691848de69a400990d074f192b378863cbec6270d14

SHA512
ad617694d11a349482c0dd76090762bee2d95c918848ef0f2874a8bf049d580be982b46a5c0cf94ddd0e41578929fd1bab912903c02c175bca9de024f404e8ce

Download Submit
/data/data/xbz.mcnqy.yoynz/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/xbz.mcnqy.yoynz/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/xbz.mcnqy.yoynz/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/xbz.mcnqy.yoynz/files/PersistedInstallation2103733596187672077tmp

Filesize
569B

MD5
3d6c83ef07d5f428f6ef3ae34d1f2d99

SHA1
120d34383b52719c24941171065cfc8655c45ffa

SHA256
cb9d611afb2477c2d2866fc59b414f652adc4f598c038dd8e42a165d9d4456cb

SHA512
c2515942d49f7737889ebf09fe548961dac8ef81561e99fd540680a8e4ea42d428b91381248f48a3ee6ae3139679844c3942094852ddc19fa71175701ac708ea

Download Submit
/data/data/xbz.mcnqy.yoynz/files/PersistedInstallation7063133756363836775tmp

Filesize
90B

MD5
d647c09234e7707cbcee40eeb632cded

SHA1
9a168eaf444b69fa3a41a41227e3521137d039f5

SHA256
d45d93b5b9239f6839ef1b61324feba8c877151c4c24222b1e471d3607557c08

SHA512
d68d2cf02f2bbd42041072e4722b7e83d2ac7c777566bd25fa4b3ce3439b7045da24fefc047ab2b1aa9a02bed735cbd535ea8f23fe2445e1f2630c16b040981e

Download Submit
/data/data/xbz.mcnqy.yoynz/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3739ade3e4c95f8aebc3b6c7857499c8

SHA1
3b59aa09d95e18012f2885fdaadb962a70e2dfe7

SHA256
9e6ffacb6103c763039419bcfe16226c042758530d0b3ab2b52f7cb67e18277f

SHA512
c4bddab5293a5d40642f5f8380c82e3b274c8dea93660c45928efda087c3a338d3f752f719e93e898bfea8d72d1a4ac4354332602edbec3f90b73b4f9c414446

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
67373430754fca506050b34554508272

SHA1
ff6333ae650100b753e772c32025c7a0428d44d3

SHA256
6ff5888f02bed6a5bb69e74b800d45393af7e16379ea485f154d8fbe0f5d7b35

SHA512
a3bc518327fb112afcfae03f3a6c1e018d51b7efa4b515b62d25b45acf45b5310d61a5535e96fd5e5807b79f2bafe61b959c51b99c6952951b26c707af1da807

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
e3e262722308e52b5325df8ae9cad937

SHA1
9ec8823bc53fbc98ae77f42e4d7309fe042f34f4

SHA256
44702c817e7a51c20b1759d1157ac1aa59fcca3fa700715532bd08b15af04815

SHA512
a087be1c4e2f2f897875d2e5a33cdb87b57169055694d708257df5e3331630b239193b7d8615370db990732b99c9ab91f816b04b610463df7eb2fe6f532fe49b

Download Submit
/data/data/xbz.mcnqy.yoynz/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
3e1b420995607fc6588fe3edcdfe9251

SHA1
1d637687e95c2ee6a40f01f8b52736b2880a0646

SHA256
69aa96e9069c3d7c4c51ad91bb213211ccad58c8f2afd3daef35eb6d6a42e9ef

SHA512
d1b4cbda6ebb486ca46770c16ab3bd119dd0f0c9af7de21e007a514b596d265c278f7828ce369cf7e25f03e9514f82e66d9530b968299bd15675e0059bd7372b

Download Submit
/data/user/0/xbz.mcnqy.yoynz/app_dex/classes.dex

Filesize
7.0MB

MD5
331572277496548ce3e1c97e210dd00d

SHA1
41558d5d89cee2e268291b02fb15a3254845f543

SHA256
3a312d0c77cc8ca0d5b1cf6c0b73ac18099a38d287cb89e5a34ccc33b496aeac

SHA512
fe9c6cc3e8c9df055635e98e9b4ef6df91fd45bd362ba7b6664aa2568f3889773844eaf67b14a5f10374fce3ae2389e2c50a65cd032bdb9989775d509f213682

Download Submit