Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
118s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
20/11/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17.apk
Resource
android-x86-arm-20240624-en
General
-
Target
437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17.apk
-
Size
4.3MB
-
MD5
48f932bb31e422704fd463f73cdad524
-
SHA1
7e4b17021fe450b7b7eeae08b9988afb84bf9245
-
SHA256
437e9e03add8620bbaa60bafef93dd0c62a6c4897225431a4e36ad88baa9ea17
-
SHA512
e98433cc4d23155cc545a9370a84a18716c8d4da66d782837b5848e253a44e9098e20afbfba0904abd0aed48c4c4051c908790af73ebe42b603598364ef66813
-
SSDEEP
98304:G9ax8Tx8QDAVQnxd11D6Yw9hEfA8iOahOYB+37C4lQT4q44YyBrMbCdiR:618QZnxleYw94AO7H7ZQTk4YyRUSu
Malware Config
Signatures
-
Android SoumniBot payload 2 IoCs
resource yara_rule behavioral1/files/fstream-1.dat family_soumnibot behavioral1/memory/4223-1.dex family_soumnibot -
SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
-
Soumnibot family
-
pid Process 4223 kuj.uva.pdn -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/kuj.uva.pdn/app_dex/classes.dex 4223 kuj.uva.pdn /data/user/0/kuj.uva.pdn/app_dex/classes.dex 4280 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kuj.uva.pdn/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/kuj.uva.pdn/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/kuj.uva.pdn/app_dex/classes.dex 4223 kuj.uva.pdn -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccounts kuj.uva.pdn -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts kuj.uva.pdn -
Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media kuj.uva.pdn -
Reads the content of the MMS message. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://mms/ kuj.uva.pdn -
Reads the content of the SMS messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/ kuj.uva.pdn -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock kuj.uva.pdn -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo kuj.uva.pdn -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS kuj.uva.pdn -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver kuj.uva.pdn -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule kuj.uva.pdn -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo kuj.uva.pdn
Processes
-
kuj.uva.pdn1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the MMS message.
- Reads the content of the SMS messages.
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
PID:4223 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kuj.uva.pdn/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/kuj.uva.pdn/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4280
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.0MB
MD5bb2e859ed4055b0fa9d40e3c9e7a04e1
SHA1dfbadd6feeed02ad8b71f3d0172929d9b1401f87
SHA25697ba27da82e3b3573ab0643440e4199b6237d075bd5824220d0cedfea1340fb9
SHA512d4ee86cf22610fdcc5bd41f4ceb89420aec93de48150c90c61dfe67c8615a447855c95f606e6cc6d79f4fb2e10f3f95d8299c1a1817a28d09d054415a608db59
-
/data/data/kuj.uva.pdn/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp
Filesize166KB
MD5f75aaa920b08fa0e17bc524bcddc3747
SHA108b960b03fc9c3373940da5ed8ba8955f367c8de
SHA25600af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657
SHA512c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371
-
Filesize
180B
MD516a32559ff60385966e73769320fc47a
SHA199dc629f36569817bcef80abdea8d21ff876d14b
SHA2564e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96
SHA5121b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
512B
MD5482bd4a26137b94b5822b7a2be7d38f8
SHA1a936057f8c51f52b6966150364a899ccae8d1b6b
SHA2565749dcba01bf307d6f86a3ac913185a7735cf713a119c6ce552ac1356c473a2d
SHA5122b97eaa3d9b74b41330cdda87c18546166846d8bae0c033d8128966b872a0d64d6ffb9db5be2d58f1182e435a4303453dc90dacfc05a2e51dedd7e04ee38b299
-
Filesize
32KB
MD58bf9d75557ba9622ecae280f63bd9645
SHA1cd38e21481ccb603a7bb6798634bf6de5e908253
SHA2563d5354d9241d7bfbb6639ab9af60b902c6c769b0afadf80877b601f32b39a0bb
SHA5121a9482028e8257f13fa0d749263f2ea88d45f4a8684552ed2e4ab8479e29a080e4ed2fa6fa135a9a065e87d814639205ce69473ee3ef0f2bf10af1e091eacd27
-
Filesize
90B
MD5d3074e82cf86040c3516f92467f1c55e
SHA184bd3ea21a72561734442686845e3ea9d7a1f375
SHA256798c8887c3356b4e5fda5bd686c52f837d1c2ab3af7ebc472092b20e26bc7dc9
SHA512208aea743f2747226deae9d8257262c2c51ab3cbc3af8445e2c7723e3312a6d8ec60dc6b8009e70b6b3fb5f16361a2fae26d1defb3142543662692478c571f2a
-
Filesize
569B
MD5b5df279c06bd19a326f33ca7cf7c282b
SHA10a70d9e33c55fb85d1b192b055fd6bfedb2a3957
SHA2567a48c607e36382e8022a0cbb62f3eb87c31e363a6d8f1b5e48dd65b92bbc42c0
SHA5129439405ec2ab04dc095ded2240c60160c184ab2d6b3cb923a18625b8e4fd128b3791ffc4cb61ed216bc1cfd31650620861fb80d97d9b5e88055be990c7f868f0
-
Filesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5753dee5d7750359ca9c157b99362e82d
SHA1e7f6d3ae3b01105b7117821c0670db3208205a24
SHA2562a9e9ab54dbe31d453a52aeb07d4e5be1d1cbc882630acbefd315c32a47a19ca
SHA512a2214d3e2b339ae992d16d226a24ec6c8fa76bd0816c9048c008b43e6affa0ca3dc91457e1562bda845930cd9b5c26ed4cb077dc404824eeef7fb6e170ae71e3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5568b442ff212cc961b53527821b01722
SHA1e5c51a4ebf45d1f43f57cc08801f83899b11a578
SHA2561e2de1a235dcfb706b2cdce21e6fe6f5ad0b99592c2164c06e5262aeaf8d7b23
SHA5129b690b0063b130c73aefaf4f8b2f8114d1bb25e874acad2d27746ae7bd30503d54d9226f8b118dcca2a773302cfff45b1ad0adafbcf8e192f0f1d15767b33840
-
Filesize
112KB
MD56238acae9b8c04bdb2cc61573296e0dc
SHA115a3aa3bc6cc27820df565ef15f1d4cda7938269
SHA25610b69bcde7622a142e26870a454b14b7ff99c656f5c0782b02311c53935e7d08
SHA5124d303a95756bdadc71b71315c55defe362539798e56362cc93ab393ec26573bc4cf15eac61c824f22209df3abccd3e2f430208742355842b1d38c284f49394ce
-
Filesize
233KB
MD553e178480215957076c2826a19ea583d
SHA169e6be083edc060cef2edc4c663dc64f28659b5b
SHA256b59892ecedc72ba341960401bb23ce3cae40ee9b3e3050e130d07904685f25f6
SHA51284b7b623daf9b723a9294b0debe9e5005816987e719f7f05c0b7b5ffe707b6ab0f6486fd141dedd54a33f5648acacaf1f0668781ecde8b88ed370abf83e6ab8b
-
Filesize
7.0MB
MD56e275e979fda39ab761be65593489275
SHA17d56390c382c2f17d228a2c584f1aae313b1d728
SHA25636a5d3c7be905f32499d2642327ce2b283cd6c771f729129530947015fbd34a8
SHA51231ddf0faeeff792788256ac963baecec18c0228c30512d8d3521487cbe6ecb346c9e53a0fd2679cfefe53d17da9c24296ba9aa76ed668eecf697d8b7c617495e