soumnibot | ec72e22032c926718c519fe2651cbd12c44fbb0a4c950ae39db87158b065eaa5

Analysis

max time kernel
149s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17-10-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec72e22032c926718c519fe2651cbd12c44fbb0a4c950ae39db87158b065eaa5.apk
Size

4.3MB
MD5

fd1e030e8af69cfe80f76b99eec9ff2b
SHA1

de59b675c8f1b97c9c4124a11321bda898a79951
SHA256

ec72e22032c926718c519fe2651cbd12c44fbb0a4c950ae39db87158b065eaa5
SHA512

d78f04375ee3325e76b980fd6bf9a53815bad0cc8cd888bb816bd0b88dd62fc028d0c8544f43a114c10d343bd4120a7cc161459feecfebf8d21a4c31755ccf96
SSDEEP

98304:L9xxHYx8/DAVQbtbDxXt8V5OHtGjOJUMOJkM4RZoXp1w1//pdcU:JC8/jbtbDxXt8+HtG6iMnM4W1wxcU

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4318-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mbe.ezf.olnib/app_dex/classes.dex	4318	mbe.ezf.olnib
/data/user/0/mbe.ezf.olnib/app_dex/classes.dex	4345	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mbe.ezf.olnib/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/mbe.ezf.olnib/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mbe.ezf.olnib/app_dex/classes.dex	4318	mbe.ezf.olnib

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	mbe.ezf.olnib

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	mbe.ezf.olnib

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	mbe.ezf.olnib

mbe.ezf.olnib
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4318
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mbe.ezf.olnib/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/mbe.ezf.olnib/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4345

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/mbe.ezf.olnib/app_dex/classes.dex

Filesize
7.0MB

MD5
ffa7df8b172d4550a73cfd64a3a8ebdc

SHA1
29d47a3fdccd3ffd43d008f726775a81daf84fab

SHA256
bd80e68c95fa456d53382e01f0f4bfad5d150584bf9e4728d010e7dac377ead3

SHA512
fd69cd75225bd3fca0f71d3cf4813e4ab2591a542a1ba686df1df8dcbf2f20a4f753f3a5c96533c39dc94db5383bcce349299efc515f3d2856f7498a6a153f4c

Download Submit
/data/data/mbe.ezf.olnib/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/mbe.ezf.olnib/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/mbe.ezf.olnib/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/mbe.ezf.olnib/files/PersistedInstallation3581721186936594182tmp

Filesize
90B

MD5
d5046fc65e100930924b0d2faf561eee

SHA1
6ccbf03e2aa704f729a88bcd8aeb4838e618b68c

SHA256
31f6a86fc4a8dffb077acb9c47b28b9e5687a6547d66c3bdd0cd476baadf6ed3

SHA512
71aaeab77c5887fbecd22edc341e3d096c205a22d98431fa038893e9afc015f5447ea470596fb87dbfd5db231b595c517e7dda0222de69c78f1909d0a7dc39ad

Download Submit
/data/data/mbe.ezf.olnib/files/PersistedInstallation5148558156001511460tmp

Filesize
570B

MD5
beda96fe25a3c7e1b75fc6755811fa6b

SHA1
a9278ab3d240f77638b0bae18ed16316fd929424

SHA256
82995c61aa84d01378e7cf8ee12cd5de291ce419e88fce60a5677fbdac025ef4

SHA512
6eeeb862eff6ba18fa84665ddecdc7c65955fd93974a3529b7534e4bb88b1b571bd6a6ebd696735da5f06a332381f6a64f0398b8100b2f451e0ef1ee61cbaf52

Download Submit
/data/data/mbe.ezf.olnib/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5a8bae6949a1c0cb1c8cbbaae589f25b

SHA1
e5f2b1fae59f65df7383e9164e207966b8dca34e

SHA256
460155950b2ee919e70ead01b827f0b14a8eec470a1e5df424efa156ef773f55

SHA512
0b062608a2af5b3731b2cbf7153de673753410eb4f82ace6b232479fdb9795b8543b1f133be2804d7f424b9dd5b695fed6bc72c99178f9b0db7e0c1325506fdc

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f73674e9d80eeba8db58ebe6342b22be

SHA1
11f6fb2a17d17133c5d2220a82a6472d6690579d

SHA256
ce519870f4cda12c09f7364a35479183642919716805f334d97c4f7de94fa872

SHA512
5b1c67afba2765ff7590caeecb73942d038121b782710d577081e6191953825193785ab8f634421288f7887bd2c18a64692e4c9de6a81ae2cc9aa0dc5e985900

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
723bb8576861ac636c95343578ebf47a

SHA1
4acd8c386dc22994eb403d6755551365981a8330

SHA256
fb448fc433b3bd1e7daed82110c26d3b0431d57c100930b7c342f6e769678bfc

SHA512
10923e09831bc2d708f02261c68885a5fea0f6ec508fa6942a0df3057e2deef5a1cec68881ff6f6c1e2205c6cf00583ce8aaf184e029e913dbf55bdc092767e5

Download Submit
/data/data/mbe.ezf.olnib/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
fbb2beb75096c963f601d54c31ba765f

SHA1
4f808a330048fe33d5a40ff3fe0df3dc96b869b2

SHA256
1a015b2a57c66503e14890a79d697d281c678dc426ccf342e7402b929e8be221

SHA512
6381bdbca1b5853ed9bb5c86339a1aafccabdc3ed377df802857402cea2eecaf64db1f17ece339a153da0592745a8e2c35d1be746146ee0ef03b5b7fa6e672b3

Download Submit
/data/user/0/mbe.ezf.olnib/app_dex/classes.dex

Filesize
7.0MB

MD5
76230c42ce5d2a3e4f3e27f6527dc57e

SHA1
56be023cf07fb20fe710114d4a9e7cb860729994

SHA256
899a30ca2f0be8ec4ba3f6389868a80a45544bc70b63d03c320b41d080e5cb36

SHA512
f458e590c00b5a1c1517f2ae2b488142484fbf2bea3fbf396954b36351a7f8b8c398b4cc97e3bfaa8051e069ee10564d724815c4199f3e4b9b4f86a7207fa481

Download Submit