soumnibot | 5f39f5f6c699c46dfcc5493d4ab21990be5d9e2514963a23b650235b7ecfaf2b

Analysis

max time kernel
149s
max time network
149s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
12-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f39f5f6c699c46dfcc5493d4ab21990be5d9e2514963a23b650235b7ecfaf2b.apk
Size

4.3MB
MD5

1b4234423265834490a2bddf4e2657dc
SHA1

5c3dd46572df5b9ef2b8bf8cbc256879b11e1e28
SHA256

5f39f5f6c699c46dfcc5493d4ab21990be5d9e2514963a23b650235b7ecfaf2b
SHA512

77dee2320acc0c478939778401bdd9ec943ee953e31a9105e7b5dcb15e95751268a6de59e968e5cbff4af6a6859f24a5f833759f48cd48f01eb03d25515e04ae
SSDEEP

98304:19xxHhx8DDAVXqkuQHd7VrGByesqiQFLTv+FMmgN4D3Wo3Jk86EojZM9ndwiHgdc:T78D4qrQ9Ji6p8L7+FzDtZk86ZZEwi8c

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4337-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex	4337	eybad.onqt.dugbi
/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex	4363	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/eybad.onqt.dugbi/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex	4337	eybad.onqt.dugbi

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	eybad.onqt.dugbi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	eybad.onqt.dugbi

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	eybad.onqt.dugbi

eybad.onqt.dugbi
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4337
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/eybad.onqt.dugbi/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4363

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/eybad.onqt.dugbi/app_dex/classes.dex

Filesize
7.0MB

MD5
92c04bff1793d5d4996ca4efc8adfd2e

SHA1
dc02cee02a31431ceb320097f49efca9487f80ae

SHA256
9cb668f9bb56d391765d24670180b3369563bf3f790a8ae9d258cf2cdb1f840a

SHA512
b8a4670d5c9251bef56cfb2fff223069559283b4e3281405a76ad8536f7580d1da2282d6a0847581cec1d5975544988ef1fd3749ad8847d25ec51cd74739140f

Download Submit
/data/data/eybad.onqt.dugbi/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/eybad.onqt.dugbi/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/eybad.onqt.dugbi/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/eybad.onqt.dugbi/files/PersistedInstallation1142710234144446081tmp

Filesize
90B

MD5
e6d770a5d98d9407250dd1305ed17afb

SHA1
57a1f4eaf31c0f3d433d031ca58dd36df2930311

SHA256
8fd8f303b8c2f032fea1ef96ec68fcf7244c80dc9f9b6f9d0edc9463d62cd8ac

SHA512
285cbe965beb37ddfea9f02111fedaa991e57c9c007e75fdce8dc1b7307df4f4b01ce9ef126774e2316bd0420c4841a83a6a22dee0e620e82f6c8a8b668b68f1

Download Submit
/data/data/eybad.onqt.dugbi/files/PersistedInstallation8759465701714067607tmp

Filesize
568B

MD5
a5d0172be1e85791481437a5248e1c65

SHA1
15ed1ad59d787f3722826f4576964206644bcfb8

SHA256
b1ff446aec3f6c5e5cafbcd84a080818fb2af995ae3a013a853b617f08dca24e

SHA512
f9c1019ca5ce29fc3f0b3d5994151016bbfc8eafd1dd690bd7d126bf89b2edee98a69dc696dc64f0e33581059568eed5cec366f5dedc4e2e69d236c9277fe14d

Download Submit
/data/data/eybad.onqt.dugbi/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
30cdf908b5912ddff1c36078683f04db

SHA1
ce9c836a46e1b14b86632bd42ca46c7bd5ba9dbf

SHA256
0280259ab52135039a91f27d4fa28ec920cdc498bb62498668294661a39de419

SHA512
aa1a353d0233f224d67f0c9293c1d9f63a3347b82c7839899990f968b1f8ee0752e4bd494df62735b19543f1eb626bf01825ab8e333882d0ff7a2e3e3607884b

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
52cbdd0f345d7bfb825ceabfa4b090e5

SHA1
75a3b0361f3a68ae56caf85c99d1d1c1b39ec69d

SHA256
5b8a7b130d69e74d6a3504b1de1edd410d4a7784a3c5caf715fbc1508d74b430

SHA512
49d6297146a2cf0255e2345ef0dd4fe78d69917aa3c50166505541153dfa23afb69876dfa4c83269982620f5f976b5d4becc1ae6fa65811dc839418ac22da632

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
dba7bfa0702207d3fd1f380437eea126

SHA1
a7689abfb77075ccd124e6885cc7335b8f8e46fe

SHA256
47cf55e8392be219756b182203e8c64af56eb6b5d7a799cb7a48fe00ecef6747

SHA512
802a55bd65831c3c9f6542055762b98ae4d9ad3fbbcaf01fbbf11a85f417498c222a6333681b1a6f22a8d6d556e300d3e64708c3db78706d997ba19632cbeeba

Download Submit
/data/data/eybad.onqt.dugbi/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
7044baa3f9edbbf878a0926e28d1e85e

SHA1
7585b244ab70005c655a09e309ce276262a13c0b

SHA256
4cf0ac3fe3b6e53548f42e3af058a0e85047f5b3ff9cec289f945bbf9518c067

SHA512
9de2c16f43de94abf4fc8240206ad49f16a84bddec4292b2881867ba8d0e67a24d5a41387f9c906e2652fe68bfc1947f7766abcdb8b657b7a10cc326bdb15204

Download Submit
/data/user/0/eybad.onqt.dugbi/app_dex/classes.dex

Filesize
7.0MB

MD5
8e5cef6c1e789ab3500c84cb2100398b

SHA1
a9e37d2125ed0f81c5bfa1f7fac69a8eebadd5e3

SHA256
689f556518203640c8b51997a43999e39b06f44c4d68d6f04b2f3932475ec3bb

SHA512
e95ae5d5b06657f6b3c31ec4717251d40bffcfe20e057a5665cebb2384c5577b4574e12997996d32f4e67fba369565ad2c06fb0ff57f85989a403a9778b79a73

Download Submit