soumnibot | 08f1f21bcc53d89117a92075a6f99b2738d77964a1231431518bb93b0a644ea3

Analysis

max time kernel
149s
max time network
144s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
11-10-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08f1f21bcc53d89117a92075a6f99b2738d77964a1231431518bb93b0a644ea3.apk
Size

4.3MB
MD5

1bfd3f22cd833b36b52eda6b8d1e1cc0
SHA1

daaaab0449e02bb4128ec8ff9f98f35471f31b58
SHA256

08f1f21bcc53d89117a92075a6f99b2738d77964a1231431518bb93b0a644ea3
SHA512

b1ab0c1fbffcb619d66e77276ca43f77f4e5dca222abbe23d1c19211568247bfd4d5876e1806685ed8c4231d0de79b876fcf7e0c85c4c1ac4e87f8d9e32bc7c1
SSDEEP

98304:m59xx0qx81DAV1tWV5J1qovcjrVykuN1/8xK8jV1WjBivXLxJsMd3:ts816tWVP1o/UNJUMjyXLLsI3

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4370-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/qy.xpw.gppm/app_dex/classes.dex	4370	qy.xpw.gppm
/data/user/0/qy.xpw.gppm/app_dex/classes.dex	4398	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/qy.xpw.gppm/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/qy.xpw.gppm/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/qy.xpw.gppm/app_dex/classes.dex	4370	qy.xpw.gppm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	qy.xpw.gppm

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	qy.xpw.gppm

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	qy.xpw.gppm

qy.xpw.gppm
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4370
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/qy.xpw.gppm/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/qy.xpw.gppm/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4398

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/qy.xpw.gppm/app_dex/classes.dex

Filesize
7.0MB

MD5
33e3b456c4092253cdf24601a84a3a5c

SHA1
a859ebccebb4ef32446e1d7d461e3402b365360a

SHA256
1aa94cd1e5b956fe9ffd449ae6a1a78e0b0fd01584fd7935f33fc6412949422c

SHA512
500b14c87bd5eaf65672e6b870acb41fcc31323fa4702ba7931471162609b872c20908a6d3f2b472fb93b9d55cbbae6e5f563881bfa68504238325d1b193c8b2

Download Submit
/data/data/qy.xpw.gppm/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/qy.xpw.gppm/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/qy.xpw.gppm/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/qy.xpw.gppm/files/PersistedInstallation1514944178263431695tmp

Filesize
569B

MD5
50da0db196cb03f4e1f7c26bb0fc5e2b

SHA1
68f8200c7fe62c94c2ffb79800272ba030cca5f4

SHA256
67f00efcc63e2b93230cb5f8cae1df02acc018db9503184eb114a97ef6636bc9

SHA512
42a13574eae54e3ad2bf23a33e3b45ab2009b847f2ef88cf4e9c955a8d060134f61cfa474b7b0102203ca9e4505f6dc26c07050518df1fc48e90f6709928c351

Download Submit
/data/data/qy.xpw.gppm/files/PersistedInstallation6759076711349971040tmp

Filesize
90B

MD5
24b36edffb44cb136cd00b9361baa756

SHA1
945ccb1884df1a9ffe2a506e929a92a30c96ae98

SHA256
8d44ae8fc55710d0819d6f90fcfa7bd41c4b9e37b67479c9d0e70b847ad6deaa

SHA512
a1062fb2177c69851cec59796cd2f26dfe1a029f4c42942ee7ba2052588171b9a2b8d4321d31d9f6efdc4f2ff34abf3e01b197c1f53c24ac31ace9d16f3618b9

Download Submit
/data/data/qy.xpw.gppm/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
f5158f636cc6adfb63870d7f477db3a9

SHA1
928f07eb2c8fd89773eb6fd31649e4476505a2d7

SHA256
1cf9fac9c4c22a85d6386ae0bdb160f5b21e03448475c89b9a93180aac370ccd

SHA512
388891c2d88990b2739878162d1df180a695260530ddbba877730998275bde8c07a7d65dfaa33637640f520d272ecbd9c1c60d60da0e00350cf3b345f7fcec62

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
67fe468271f3e2887928e1505b164003

SHA1
b37ae0e694a8865874e6866c07ce8b215a73c352

SHA256
cf47be1fc128173808e193883c813a6954403dca91be11410d8d4472c91ad057

SHA512
ae0e05a9b5ea40950910cf7da01159bc866ca7e8b7cd87cf5afc39f639e16b7c1a0c96f5a6b0117f357b3f9d89d5b60f44d139e3f15b69a37ddaf854b31de788

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
65867c927a8589336cb6e010f0e5e7f5

SHA1
c468bee528e3d8688fec5de9dacfb829d2fbcd61

SHA256
1f1b37e7224dfd5ba93459f69a523b9278873bebde3df553f049dcfb3208f0f8

SHA512
273165adc524d0f89c4178fb32f14f41d80385fc02062b9f3ec551a08d6bb25cbb30151f86fd5a92df4b3e8242d1c2be9eb26b1b38ce55a55e1bfc43ed7be5e1

Download Submit
/data/data/qy.xpw.gppm/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
2766423c1418d8c738676e58c6c9369c

SHA1
98a88b0bb80c642e2e2afaf0901e72c64aa4fe1a

SHA256
34e6369b18da82e5128db70d79e9ad05df4277fbaaefb4c4a08956a7d407e2d7

SHA512
ab76b8b48797ec8845fa842a70e6ada3a590f32d69cfcf77871773198b3b46f6b99c1b3bc827f76ac683bfa3235980474db1f327f7ea13a918623eeb13115f8e

Download Submit
/data/user/0/qy.xpw.gppm/app_dex/classes.dex

Filesize
7.0MB

MD5
47871e5e5805f0c8ce636cf2cb8ed9de

SHA1
801a0197740b506b837143c2350e6f95aa32fdff

SHA256
041de445e3a5431fee37227d1efa13a246b7437ee8be54cb4742db98ea29eb9c

SHA512
148bc91131199f0e392285c3de0742cdeff592f2b638e5507ac3b9cb4396f7360f8268e8757ccca76f30fb81f7681efc01183c63e4e25582e179e11706aed786

Download Submit