soumnibot | 8cbe4de4efe567f82cd9b9f3e8ae17d16358ea75b922e8751a3a10041ba2a86c

Analysis

max time kernel
149s
max time network
154s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
12-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cbe4de4efe567f82cd9b9f3e8ae17d16358ea75b922e8751a3a10041ba2a86c.apk
Size

4.3MB
MD5

bb674fd9f2770871b428df68361aa6e8
SHA1

a254845f45d8d61978e55b3234d4804cee1f4c99
SHA256

8cbe4de4efe567f82cd9b9f3e8ae17d16358ea75b922e8751a3a10041ba2a86c
SHA512

e87c8970d358e420fed807b28f3a2b2aea8df501a19cdfc509ad1b768ad0ba304e0b847c3e3b073b5c8dc650b63c0914b6f23dadbd46a08058e62626c183213c
SSDEEP

98304:s9xx34x8zDAV6hLTzVNkwlb0vFoVoBt2dyRKyNjNOnlwa6f/zGMtmhfdr:ki8zhhXzV+eo72+xpOjC2r

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4221-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/de.pwlvjr.soub/app_dex/classes.dex	4221	de.pwlvjr.soub
/data/user/0/de.pwlvjr.soub/app_dex/classes.dex	4314	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/de.pwlvjr.soub/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/de.pwlvjr.soub/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/de.pwlvjr.soub/app_dex/classes.dex	4221	de.pwlvjr.soub

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	de.pwlvjr.soub

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	de.pwlvjr.soub

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	de.pwlvjr.soub

de.pwlvjr.soub
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4221
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/de.pwlvjr.soub/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/de.pwlvjr.soub/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/de.pwlvjr.soub/app_dex/classes.dex

Filesize
6.9MB

MD5
50d44e913a0926701d9c98fee41b8760

SHA1
5bb96e0b7a6c27a5f1e5c8c0f8b4c4be3682954b

SHA256
366aafc9ab1b9f0ea5e34221deda4e56d542aabbe49ca0f3f00a8eea661b192f

SHA512
7ac62f21aba63395ce26302a7f107837a16206c993db0a21b6ed3c2887225b32ca63de710958ad2b72cb23807edb81791cc9761303c25dbf9c1a2c725738779a

Download Submit
/data/data/de.pwlvjr.soub/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/de.pwlvjr.soub/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/de.pwlvjr.soub/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/de.pwlvjr.soub/files/PersistedInstallation1591305080347056127tmp

Filesize
569B

MD5
04b2386067ad83b3f77cdb85aa7f26e8

SHA1
7fede4568c4a4ad5291d19418b06ab2db0ce565c

SHA256
4c909b5d993a669aad636cab216368ea1ae72266230a35bc9cd4a2bed184392c

SHA512
a13f9811a1dd04d8d9573e3a1d5d6100160b698d750c4982ac79192d1748521605fb340ca3e96c9389ea823e777e70b9977d5ad1d31961d3406a92cd20bdb696

Download Submit
/data/data/de.pwlvjr.soub/files/PersistedInstallation4680086007440913614tmp

Filesize
90B

MD5
332501fc7ac66fd9b8647758f333f12a

SHA1
2fb522073740c0040c1c297e66d43b627ad24dea

SHA256
7c0b0647a70cad50e59f16e8c0460685fb2c47eed20bdbb6a3fa9ab2514d409d

SHA512
4e03d0875cbf12921b9e349f7e54aab1320117ec3b441f42498d291ef732998125dc08015ddfbf0dd32498332bd65c7724c7994bb47a1c356559731d8fde5603

Download Submit
/data/data/de.pwlvjr.soub/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
58ce8765798b57f52cbd96768e5af634

SHA1
5ddacad9a50ec4458fc5f342f24f90e026efe656

SHA256
9c5683f1670e29153fee6b9f2484981853fb89a25c5b3b3a739ecbbf01d5068e

SHA512
b0f405f529d7bf18b104a52d6a8e83f9f9dc27171c12a8703f2cea526487dfb44c7b0a93569588f9947e5488a17672b3ecad2bb7e39578cc889612e69500151b

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
c0051c755be110b986c0b345e3de102e

SHA1
90c8f940609d63b2b0c0a97ed9b961bcf013169a

SHA256
b4e17ccb1e018a7159e6a1ea9aba5368a6ae9b1fb9166d05f7ca30ac1da9537e

SHA512
059ba8b68fe3ea0c03a2bb99066b303af98bef12813e6db1532fbe99f9d0ddd831f37e8a127c6aa46d23a0b06eaadff4a04cf9e8c977dfdea3a38a88f86b5b58

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
90ad45ecda26d024e7a54855c04bbfbe

SHA1
6d2765a5957ab5eb542c3b4c85e34494e64abffb

SHA256
d89f6bd873d031a0aa378eb7d6c5288eff97bbd6122055b2d34be9253c0c0713

SHA512
11719ec4851312e2aa9e561fd0d8b464183aafb2a2cd264dda4df974dc7f48c84766c82fc7b9fa2b0d0ab94ea9345fbe0979d0c46c1c88e83726ff124b4a91b6

Download Submit
/data/data/de.pwlvjr.soub/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
7a001e5a178e92026c41c05cc46be77d

SHA1
fc90d8f494dea03da5245ca76f2af87a5e001fb3

SHA256
14f470748eeec2a555d69c55432621b8823c4aaf13907d1f396cfe8ee9720215

SHA512
66201f7e694ba6ba11dfbdab4f6da7b6c95e89a311f27824471b0d8c5c125b25c087f75bfd6e63d92ac78f100206096eba691a8f5f143c598a8c395fd21d809c

Download Submit
/data/user/0/de.pwlvjr.soub/app_dex/classes.dex

Filesize
6.9MB

MD5
b5d390e2c7b0c54d292c614b429c6cfb

SHA1
6cc4cdca148868662cebe8f15c85ba52107d01b4

SHA256
ea12dfe10df7eb945bb1f6ab2500d04f0aea907a3ea97ef6f00886604977cead

SHA512
5da046ccdc1b20556aaff5b671b7f6582c44bfaca62674873be0b6f80e966e45ea608f7de365fedd9d017a3afbc0ea43e3c7b1d9ebbcf1ae2a6793f368ae0e93

Download Submit