soumnibot | 437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17

Resubmissions

20/11/2024, 10:40

241120-mqrkqavgja 10

12/10/2024, 22:03

241012-1yvt1atejh 10

Analysis

max time kernel
114s
max time network
118s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20/11/2024, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17.apk
Size

4.3MB
MD5

48f932bb31e422704fd463f73cdad524
SHA1

7e4b17021fe450b7b7eeae08b9988afb84bf9245
SHA256

437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17
SHA512

e98433cc4d23155cc545a9370a84a18716c8d4da66d782837b5848e253a44e9098e20afbfba0904abd0aed48c4c4051c908790af73ebe42b603598364ef66813
SSDEEP

98304:G9ax8Tx8QDAVQnxd11D6Yw9hEfA8iOahOYB+37C4lQT4q44YyBrMbCdiR:618QZnxleYw94AO7H7ZQTk4YyRUSu

Score

10^/10

soumnibot banker collection discovery evasion execution infostealer persistence stealth trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4223-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4223	kuj.uva.pdn

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kuj.uva.pdn/app_dex/classes.dex	4223	kuj.uva.pdn
/data/user/0/kuj.uva.pdn/app_dex/classes.dex	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kuj.uva.pdn/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/kuj.uva.pdn/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kuj.uva.pdn/app_dex/classes.dex	4223	kuj.uva.pdn

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	kuj.uva.pdn

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	kuj.uva.pdn

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	kuj.uva.pdn

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	kuj.uva.pdn

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	kuj.uva.pdn

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	kuj.uva.pdn

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	kuj.uva.pdn

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	kuj.uva.pdn

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kuj.uva.pdn

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kuj.uva.pdn

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kuj.uva.pdn

kuj.uva.pdn
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the MMS message.
- Reads the content of the SMS messages.
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
PID:4223
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kuj.uva.pdn/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/kuj.uva.pdn/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Contact List

T1636.003

SMS Messages

T1636.004

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kuj.uva.pdn/app_dex/classes.dex

Filesize
7.0MB

MD5
bb2e859ed4055b0fa9d40e3c9e7a04e1

SHA1
dfbadd6feeed02ad8b71f3d0172929d9b1401f87

SHA256
97ba27da82e3b3573ab0643440e4199b6237d075bd5824220d0cedfea1340fb9

SHA512
d4ee86cf22610fdcc5bd41f4ceb89420aec93de48150c90c61dfe67c8615a447855c95f606e6cc6d79f4fb2e10f3f95d8299c1a1817a28d09d054415a608db59

Download Submit
/data/data/kuj.uva.pdn/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/kuj.uva.pdn/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/kuj.uva.pdn/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/kuj.uva.pdn/databases/mqttAndroidService.db-journal

Filesize
512B

MD5
482bd4a26137b94b5822b7a2be7d38f8

SHA1
a936057f8c51f52b6966150364a899ccae8d1b6b

SHA256
5749dcba01bf307d6f86a3ac913185a7735cf713a119c6ce552ac1356c473a2d

SHA512
2b97eaa3d9b74b41330cdda87c18546166846d8bae0c033d8128966b872a0d64d6ffb9db5be2d58f1182e435a4303453dc90dacfc05a2e51dedd7e04ee38b299

Download Submit
/data/data/kuj.uva.pdn/databases/mqttAndroidService.db-wal

Filesize
32KB

MD5
8bf9d75557ba9622ecae280f63bd9645

SHA1
cd38e21481ccb603a7bb6798634bf6de5e908253

SHA256
3d5354d9241d7bfbb6639ab9af60b902c6c769b0afadf80877b601f32b39a0bb

SHA512
1a9482028e8257f13fa0d749263f2ea88d45f4a8684552ed2e4ab8479e29a080e4ed2fa6fa135a9a065e87d814639205ce69473ee3ef0f2bf10af1e091eacd27

Download Submit
/data/data/kuj.uva.pdn/files/PersistedInstallation149521592411747226tmp

Filesize
90B

MD5
d3074e82cf86040c3516f92467f1c55e

SHA1
84bd3ea21a72561734442686845e3ea9d7a1f375

SHA256
798c8887c3356b4e5fda5bd686c52f837d1c2ab3af7ebc472092b20e26bc7dc9

SHA512
208aea743f2747226deae9d8257262c2c51ab3cbc3af8445e2c7723e3312a6d8ec60dc6b8009e70b6b3fb5f16361a2fae26d1defb3142543662692478c571f2a

Download Submit
/data/data/kuj.uva.pdn/files/PersistedInstallation956247770283470518tmp

Filesize
569B

MD5
b5df279c06bd19a326f33ca7cf7c282b

SHA1
0a70d9e33c55fb85d1b192b055fd6bfedb2a3957

SHA256
7a48c607e36382e8022a0cbb62f3eb87c31e363a6d8f1b5e48dd65b92bbc42c0

SHA512
9439405ec2ab04dc095ded2240c60160c184ab2d6b3cb923a18625b8e4fd128b3791ffc4cb61ed216bc1cfd31650620861fb80d97d9b5e88055be990c7f868f0

Download Submit
/data/data/kuj.uva.pdn/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
753dee5d7750359ca9c157b99362e82d

SHA1
e7f6d3ae3b01105b7117821c0670db3208205a24

SHA256
2a9e9ab54dbe31d453a52aeb07d4e5be1d1cbc882630acbefd315c32a47a19ca

SHA512
a2214d3e2b339ae992d16d226a24ec6c8fa76bd0816c9048c008b43e6affa0ca3dc91457e1562bda845930cd9b5c26ed4cb077dc404824eeef7fb6e170ae71e3

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
568b442ff212cc961b53527821b01722

SHA1
e5c51a4ebf45d1f43f57cc08801f83899b11a578

SHA256
1e2de1a235dcfb706b2cdce21e6fe6f5ad0b99592c2164c06e5262aeaf8d7b23

SHA512
9b690b0063b130c73aefaf4f8b2f8114d1bb25e874acad2d27746ae7bd30503d54d9226f8b118dcca2a773302cfff45b1ad0adafbcf8e192f0f1d15767b33840

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
6238acae9b8c04bdb2cc61573296e0dc

SHA1
15a3aa3bc6cc27820df565ef15f1d4cda7938269

SHA256
10b69bcde7622a142e26870a454b14b7ff99c656f5c0782b02311c53935e7d08

SHA512
4d303a95756bdadc71b71315c55defe362539798e56362cc93ab393ec26573bc4cf15eac61c824f22209df3abccd3e2f430208742355842b1d38c284f49394ce

Download Submit
/data/data/kuj.uva.pdn/no_backup/androidx.work.workdb-wal

Filesize
233KB

MD5
53e178480215957076c2826a19ea583d

SHA1
69e6be083edc060cef2edc4c663dc64f28659b5b

SHA256
b59892ecedc72ba341960401bb23ce3cae40ee9b3e3050e130d07904685f25f6

SHA512
84b7b623daf9b723a9294b0debe9e5005816987e719f7f05c0b7b5ffe707b6ab0f6486fd141dedd54a33f5648acacaf1f0668781ecde8b88ed370abf83e6ab8b

Download Submit
/data/user/0/kuj.uva.pdn/app_dex/classes.dex

Filesize
7.0MB

MD5
6e275e979fda39ab761be65593489275

SHA1
7d56390c382c2f17d228a2c584f1aae313b1d728

SHA256
36a5d3c7be905f32499d2642327ce2b283cd6c771f729129530947015fbd34a8

SHA512
31ddf0faeeff792788256ac963baecec18c0228c30512d8d3521487cbe6ecb346c9e53a0fd2679cfefe53d17da9c24296ba9aa76ed668eecf697d8b7c617495e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads