Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/11/2024, 10:40

241120-mqrkqavgja 10

12/10/2024, 22:03

241012-1yvt1atejh 10

Analysis

  • max time kernel
    114s
  • max time network
    118s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    20/11/2024, 10:40

General

  • Target

    437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17.apk

  • Size

    4.3MB

  • MD5

    48f932bb31e422704fd463f73cdad524

  • SHA1

    7e4b17021fe450b7b7eeae08b9988afb84bf9245

  • SHA256

    437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17

  • SHA512

    e98433cc4d23155cc545a9370a84a18716c8d4da66d782837b5848e253a44e9098e20afbfba0904abd0aed48c4c4051c908790af73ebe42b603598364ef66813

  • SSDEEP

    98304:G9ax8Tx8QDAVQnxd11D6Yw9hEfA8iOahOYB+37C4lQT4q44YyBrMbCdiR:618QZnxleYw94AO7H7ZQTk4YyRUSu

Malware Config

Signatures

  • Android SoumniBot payload 2 IoCs
  • SoumniBot

    SoumniBot is an Android banking trojan first seen in April 2024.

  • Soumnibot family
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • kuj.uva.pdn
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the MMS message.
    • Reads the content of the SMS messages.
    • Acquires the wake lock
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    PID:4223
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kuj.uva.pdn/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/kuj.uva.pdn/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4280

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/kuj.uva.pdn/app_dex/classes.dex

    Filesize

    7.0MB

    MD5

    bb2e859ed4055b0fa9d40e3c9e7a04e1

    SHA1

    dfbadd6feeed02ad8b71f3d0172929d9b1401f87

    SHA256

    97ba27da82e3b3573ab0643440e4199b6237d075bd5824220d0cedfea1340fb9

    SHA512

    d4ee86cf22610fdcc5bd41f4ceb89420aec93de48150c90c61dfe67c8615a447855c95f606e6cc6d79f4fb2e10f3f95d8299c1a1817a28d09d054415a608db59

  • /data/data/kuj.uva.pdn/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

    Filesize

    166KB

    MD5

    f75aaa920b08fa0e17bc524bcddc3747

    SHA1

    08b960b03fc9c3373940da5ed8ba8955f367c8de

    SHA256

    00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

    SHA512

    c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

  • /data/data/kuj.uva.pdn/cache/image_manager_disk_cache/journal

    Filesize

    180B

    MD5

    16a32559ff60385966e73769320fc47a

    SHA1

    99dc629f36569817bcef80abdea8d21ff876d14b

    SHA256

    4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

    SHA512

    1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

  • /data/data/kuj.uva.pdn/cache/image_manager_disk_cache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/data/kuj.uva.pdn/databases/mqttAndroidService.db-journal

    Filesize

    512B

    MD5

    482bd4a26137b94b5822b7a2be7d38f8

    SHA1

    a936057f8c51f52b6966150364a899ccae8d1b6b

    SHA256

    5749dcba01bf307d6f86a3ac913185a7735cf713a119c6ce552ac1356c473a2d

    SHA512

    2b97eaa3d9b74b41330cdda87c18546166846d8bae0c033d8128966b872a0d64d6ffb9db5be2d58f1182e435a4303453dc90dacfc05a2e51dedd7e04ee38b299

  • /data/data/kuj.uva.pdn/databases/mqttAndroidService.db-wal

    Filesize

    32KB

    MD5

    8bf9d75557ba9622ecae280f63bd9645

    SHA1

    cd38e21481ccb603a7bb6798634bf6de5e908253

    SHA256

    3d5354d9241d7bfbb6639ab9af60b902c6c769b0afadf80877b601f32b39a0bb

    SHA512

    1a9482028e8257f13fa0d749263f2ea88d45f4a8684552ed2e4ab8479e29a080e4ed2fa6fa135a9a065e87d814639205ce69473ee3ef0f2bf10af1e091eacd27

  • /data/data/kuj.uva.pdn/files/PersistedInstallation149521592411747226tmp

    Filesize

    90B

    MD5

    d3074e82cf86040c3516f92467f1c55e

    SHA1

    84bd3ea21a72561734442686845e3ea9d7a1f375

    SHA256

    798c8887c3356b4e5fda5bd686c52f837d1c2ab3af7ebc472092b20e26bc7dc9

    SHA512

    208aea743f2747226deae9d8257262c2c51ab3cbc3af8445e2c7723e3312a6d8ec60dc6b8009e70b6b3fb5f16361a2fae26d1defb3142543662692478c571f2a

  • /data/data/kuj.uva.pdn/files/PersistedInstallation956247770283470518tmp

    Filesize

    569B

    MD5

    b5df279c06bd19a326f33ca7cf7c282b

    SHA1

    0a70d9e33c55fb85d1b192b055fd6bfedb2a3957

    SHA256

    7a48c607e36382e8022a0cbb62f3eb87c31e363a6d8f1b5e48dd65b92bbc42c0

    SHA512

    9439405ec2ab04dc095ded2240c60160c184ab2d6b3cb923a18625b8e4fd128b3791ffc4cb61ed216bc1cfd31650620861fb80d97d9b5e88055be990c7f868f0

  • /data/data/kuj.uva.pdn/files/mmkv/mmkv.default

    Filesize

    4KB

    MD5

    620f0b67a91f7f74151bc5be745b7110

    SHA1

    1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

    SHA256

    ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

    SHA512

    2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    753dee5d7750359ca9c157b99362e82d

    SHA1

    e7f6d3ae3b01105b7117821c0670db3208205a24

    SHA256

    2a9e9ab54dbe31d453a52aeb07d4e5be1d1cbc882630acbefd315c32a47a19ca

    SHA512

    a2214d3e2b339ae992d16d226a24ec6c8fa76bd0816c9048c008b43e6affa0ca3dc91457e1562bda845930cd9b5c26ed4cb077dc404824eeef7fb6e170ae71e3

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    568b442ff212cc961b53527821b01722

    SHA1

    e5c51a4ebf45d1f43f57cc08801f83899b11a578

    SHA256

    1e2de1a235dcfb706b2cdce21e6fe6f5ad0b99592c2164c06e5262aeaf8d7b23

    SHA512

    9b690b0063b130c73aefaf4f8b2f8114d1bb25e874acad2d27746ae7bd30503d54d9226f8b118dcca2a773302cfff45b1ad0adafbcf8e192f0f1d15767b33840

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

    Filesize

    112KB

    MD5

    6238acae9b8c04bdb2cc61573296e0dc

    SHA1

    15a3aa3bc6cc27820df565ef15f1d4cda7938269

    SHA256

    10b69bcde7622a142e26870a454b14b7ff99c656f5c0782b02311c53935e7d08

    SHA512

    4d303a95756bdadc71b71315c55defe362539798e56362cc93ab393ec26573bc4cf15eac61c824f22209df3abccd3e2f430208742355842b1d38c284f49394ce

  • /data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

    Filesize

    233KB

    MD5

    53e178480215957076c2826a19ea583d

    SHA1

    69e6be083edc060cef2edc4c663dc64f28659b5b

    SHA256

    b59892ecedc72ba341960401bb23ce3cae40ee9b3e3050e130d07904685f25f6

    SHA512

    84b7b623daf9b723a9294b0debe9e5005816987e719f7f05c0b7b5ffe707b6ab0f6486fd141dedd54a33f5648acacaf1f0668781ecde8b88ed370abf83e6ab8b

  • /data/user/0/kuj.uva.pdn/app_dex/classes.dex

    Filesize

    7.0MB

    MD5

    6e275e979fda39ab761be65593489275

    SHA1

    7d56390c382c2f17d228a2c584f1aae313b1d728

    SHA256

    36a5d3c7be905f32499d2642327ce2b283cd6c771f729129530947015fbd34a8

    SHA512

    31ddf0faeeff792788256ac963baecec18c0228c30512d8d3521487cbe6ecb346c9e53a0fd2679cfefe53d17da9c24296ba9aa76ed668eecf697d8b7c617495e