soumnibot | 4f53b06c35093d8d2a63e7da9e1bd305e23257cc582f436e9ec93a6be9752a5a

Analysis

max time kernel
1s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
12-11-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f53b06c35093d8d2a63e7da9e1bd305e23257cc582f436e9ec93a6be9752a5a.apk
Size

2.1MB
MD5

de0ce23f852381f8fffa4851192f3224
SHA1

84a55eca64589484aa2d2a2071cebfbc77d1e3f5
SHA256

4f53b06c35093d8d2a63e7da9e1bd305e23257cc582f436e9ec93a6be9752a5a
SHA512

fe066efc4117c53f44951498d36bba458e467fc2ccf9111992ef1b6975d5525e55a4c0fcd0dd20ad093a120178fa004452f9adfd323833554857a083dbf06929
SSDEEP

24576:m17KKC69tOncPrGeO1Wvcrv+JdRwLonKMrhqBNeqw5hk4m51+WtE0h1qfrEqkvgm:Q7KKLVPnJJYonAvwvDJWu0h1O2gS5QMX

Score

10^/10

soumnibot banker evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4521-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/qfyf2.irbcx.r8jj5/[email protected]	4521	qfyf2.irbcx.r8jj5
/data/user/0/qfyf2.irbcx.r8jj5/[email protected]	4521	qfyf2.irbcx.r8jj5

qfyf2.irbcx.r8jj5
1⤵
- Loads dropped Dex/Jar
PID:4521

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/qfyf2.irbcx.r8jj5/.jiagu/libjiaguv1.so

Filesize
226KB

MD5
5107dfedd09395af41fb9eed0a945fa0

SHA1
cd00d76fb6ea1395c86a130058102fa164c8cb0a

SHA256
b18f5f324b7b8af370156949098be6c48d20ab05475203ec84a980a058563d95

SHA512
9d22986ad1ce3e21696584fcdb4214db1e2811bee008fe8fa4b57ca2517604db35522266480e98705446e4aedbb72a95c89ae7046560ceed200893ec185957d3

Download Submit
/data/data/qfyf2.irbcx.r8jj5/oat/x86_64/[email protected]

Filesize
61KB

MD5
26494f26c8e62c7f93b7cfee3cd2dcf1

SHA1
1ebf00398b1975ec1f30462b8148f2776e697077

SHA256
c097c33892aaa49545675c7cabaac672cd81d8aed4c7c541aaf78088a5c2c267

SHA512
dc9bb36bb561f033afec87a659636faff51faf0528567fa461746a87b85b11bf57fd1d41befed2cdb129b235b270a483414e80ac67e8d49d5c4488c8816b06f3

Download Submit
/data/user/0/qfyf2.irbcx.r8jj5/[email protected]

Filesize
2.2MB

MD5
e54ad7f392948b9cfd35ede2023688d5

SHA1
13b6ca585c29276315a4ce10aafaa5c24a7137cf

SHA256
582ee291c586da50c0fd9aca081d9c14afa4b4b3f03481199e64627c0effa671

SHA512
3a8e133420cfd4663b003624a24f5aab68c4c9fbc3d1c25a32331ef04774a4d0c4b90e1630fea0fd46fcddd3e9a597e8b070cc08d13573c9ee168f050374c518

Download Submit