soumnibot | b6a47c0908d5563ec50123164dadff6b137ec80c2f2ab6375a8f30ce975b6451

Analysis

max time kernel
1s
max time network
155s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
12/10/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6a47c0908d5563ec50123164dadff6b137ec80c2f2ab6375a8f30ce975b6451.apk
Size

2.1MB
MD5

565a5480e8d69683c2fb6e9a4023aa0b
SHA1

0119da9d5cc5286640e79c6bb0a63e4669a290e8
SHA256

b6a47c0908d5563ec50123164dadff6b137ec80c2f2ab6375a8f30ce975b6451
SHA512

3fcab9c23d7cd49cbf8ef51b0056cefc0eb9026714aac611e0cf14e8a28e4ea08b3041227000f01cd933b104fab4036185f1b7a8552d1740b15b5a4a14bf7cf4
SSDEEP

49152:N7F5S8RCLTjQ8KhULf53FGlS/VJWu0C/uI3IBZAV:N7XT8LjKh+PGQcC/uXZAV

Score

10^/10

soumnibot banker evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4504-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/eya07.lga3t.pfrfk/[email protected]	4504	eya07.lga3t.pfrfk
/data/user/0/eya07.lga3t.pfrfk/[email protected]	4504	eya07.lga3t.pfrfk

eya07.lga3t.pfrfk
1⤵
- Loads dropped Dex/Jar
PID:4504

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/eya07.lga3t.pfrfk/.jiagu/libjiaguv1.so

Filesize
226KB

MD5
5107dfedd09395af41fb9eed0a945fa0

SHA1
cd00d76fb6ea1395c86a130058102fa164c8cb0a

SHA256
b18f5f324b7b8af370156949098be6c48d20ab05475203ec84a980a058563d95

SHA512
9d22986ad1ce3e21696584fcdb4214db1e2811bee008fe8fa4b57ca2517604db35522266480e98705446e4aedbb72a95c89ae7046560ceed200893ec185957d3

Download Submit
/data/data/eya07.lga3t.pfrfk/oat/x86_64/[email protected]

Filesize
61KB

MD5
8aa7490d86eee8d0faf99356d066e66b

SHA1
a3de7e8ab72fafc49f28ef0bc0459a4426e52e67

SHA256
81309d993f3a0e2e4b69c6c1f5e013af7ef42826bfa2d8b3637a121fd782cb0c

SHA512
a26ffffa1f540e4bf077ae63d8655fb4244c776019aa7058291a510c93adf809813f1424fad0ff9fdbe167f6a2901570a67fcdb8dd35102e4f388c62792e28bf

Download Submit
/data/user/0/eya07.lga3t.pfrfk/[email protected]

Filesize
2.2MB

MD5
beda3408ea55240978165ff8de101c0c

SHA1
b1eef1266f01131eafcc3746cba4ef9a6f188ddc

SHA256
0aafc85d00f3b3bf3c4fcfad46d7c39a7ca332333e1491b41068a4a77eb7a470

SHA512
22635be91443b515eaaec17ee9e56d7b27d57bc9b4dc265304b9ca9c575437bf20d0ea42e765fb2dfc1667e259d423a0f8ff93f21abca6d870cb548475c62e5b

Download Submit