soumnibot | a4b08cbacf079c8aee6d3cf7855bac5e83368942a52ac2c081234ff685bfefb8

Analysis

max time kernel
149s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
12-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4b08cbacf079c8aee6d3cf7855bac5e83368942a52ac2c081234ff685bfefb8.apk
Size

4.3MB
MD5

2a0dabd9682b2569190f364a02b485f1
SHA1

3b1dd7031f82da48f12537f665a14892583ce466
SHA256

a4b08cbacf079c8aee6d3cf7855bac5e83368942a52ac2c081234ff685bfefb8
SHA512

c89b0aa8f2d457106b20a3df82393a94fa3ef4d694975a5065bbadd8c0e6c070b3f4cbf41d024e72944c5492529e2731464219a5fe6194cc8f0a94a48a9c1cac
SSDEEP

98304:u9xxm5x8sDAVEY/ySUBoO8zA4WF7+Mp+HtA/Ljz4H3nY1inWTgrdx:/T8s/Y/ySU5DF6DIzUeiBBx

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4369-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/myrmn.pyz.rf/app_dex/classes.dex	4369	myrmn.pyz.rf
/data/user/0/myrmn.pyz.rf/app_dex/classes.dex	4477	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/myrmn.pyz.rf/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/myrmn.pyz.rf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/myrmn.pyz.rf/app_dex/classes.dex	4369	myrmn.pyz.rf

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	myrmn.pyz.rf

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	myrmn.pyz.rf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	myrmn.pyz.rf

myrmn.pyz.rf
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4369
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/myrmn.pyz.rf/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/myrmn.pyz.rf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4477

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/myrmn.pyz.rf/app_dex/classes.dex

Filesize
6.9MB

MD5
3ac21371a95a5cef917a2c0646f8dc33

SHA1
82582c4e72f5eaf828a6c5afccac1f9ef1433fc3

SHA256
d7a06a670adf306dcb1dfe627ad4a67535def0442dfd34577b7e062b01be0a95

SHA512
efb42f8c1e84937e02e67b289210077411f5c9eda0c5ec2335f970f8c00780dfd7be01fc9fc8016b22b338fbb15b0793e0c27afba065a72ac644e2cafe67551c

Download Submit
/data/data/myrmn.pyz.rf/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/myrmn.pyz.rf/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/myrmn.pyz.rf/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/myrmn.pyz.rf/files/PersistedInstallation1928557080131034146tmp

Filesize
569B

MD5
6f74d484f1b04efa0f8234c41cccbedd

SHA1
dbb9813545feccc46bb63871a9092ea9c1e30a2e

SHA256
4bf8a3b1154951cd1404aa37c1659d62c3d863ab3bfcdd225ed319086c441c07

SHA512
6b8719f42b333ff201c5e354bf79a4cdcd2536569de48087534566837d333c7d96dcdab96d08f868c8f5459a827a6bea3d2845136032a426f0aec931b4aca709

Download Submit
/data/data/myrmn.pyz.rf/files/PersistedInstallation8062852271984759029tmp

Filesize
90B

MD5
6a06465982398565f7e11dee1d617262

SHA1
4d46b77c0a95c00669f52960b437a0f6ea266c0e

SHA256
ade277ed8fb9acb9ca0499fd3d1e77c7bee33d4337a09be33cf1e2df7befd4c6

SHA512
f3ab3932cf6a1dcfc6c7f76090c6be71cbd9a7900ad993795167880b337ac324aaabdff503d0a841c7ddef4a1738de92ab33921cd73240bb66ec9ac7afbb4fed

Download Submit
/data/data/myrmn.pyz.rf/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a1194739377a898e08c8b2bb92bc4ed2

SHA1
7f28a29d193bb78e328577a13864a3994f0d3fd9

SHA256
b92461ecef5af42671edbe5e8470626325645ba8e11eba782a84e02eaef88638

SHA512
6017fbac266da97f5f19c083a5c9b54ffdcd5f8f4d428a3b39ef9ecdb98fa8e6245b781571cddeeebee57b4ac78a7022f220564b6d34acc234650885bb104658

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6949b4d20671012b08a4fe1153b0ad7c

SHA1
d9cb6cde091fce5d3e351c5a11bd6d9639f63721

SHA256
8ae54744cd604a3166f427da6f5b52223d47614a25409d451e6471b03b9d0195

SHA512
0e7fc5322d9d23b1e6249f3f74ff1806b8873cb15caecab8e58958817d23681bb827cf2fe962e966006382fdb164fa64ca260f7780e86d839bcb4adfcc4d1bd6

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
f67c5ac48d09cddcdcfb2653eb53feed

SHA1
2971d458c9048d0413b5ae588b785db1f8b505b7

SHA256
4b115efac99d33f155070b90e105038ce27e25cbd28cbb88c570d6c88ee07d95

SHA512
39ec363e7616ee80ef3e26ffc1adb868f4836b0935c643bb299de8f054697604cb1fafbab58eb09cfb58e475c5f4238ccfdf7661b86b934b5373d97a32e7147b

Download Submit
/data/data/myrmn.pyz.rf/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
857944a3cc89db124b96103e546d9115

SHA1
36dd048a0811b76a9c8ffac563f8a6d84d6b5098

SHA256
7db48aa72c6a6ccfb80e70effcad851cd9849153f9169c02e0c06c654d741649

SHA512
74b93dd6b698af7a8161bfe98950d7bd3fb8af63f84d734ad5fa0714f2fe794549436d83050be58e699eb6f88ef4aca856f03758e6a5323ab106ee243f9a7741

Download Submit
/data/user/0/myrmn.pyz.rf/app_dex/classes.dex

Filesize
6.9MB

MD5
715d09ce7d0ed5b1a662af6d04fed035

SHA1
8187e55c53f98b15d41e17e84c15b2bb3cddf456

SHA256
2898d7745f07603ed34f44c220b34b39e2476a0675fe686c6435e69ebf8c3d5e

SHA512
507487780c8337302cc3218131f2293e6e1f74594369c53aefe4e8b980d278bb27aaaeb428bb5140e32ee12919616205949e1edf25b0778187e6c86e9427df2f

Download Submit