soumnibot | 0b9d3e86a4f5e2912a50892206d4ec33c0283142e7d2de8f8fab6ec4fab42790

Analysis

max time kernel
149s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
01-12-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b9d3e86a4f5e2912a50892206d4ec33c0283142e7d2de8f8fab6ec4fab42790.apk
Size

3.3MB
MD5

f235b6d6209816fe828dc4f78a555188
SHA1

00917a8c74fe00d4fd68b379a43ee2f0e53cfe36
SHA256

0b9d3e86a4f5e2912a50892206d4ec33c0283142e7d2de8f8fab6ec4fab42790
SHA512

091c230dafd83cd30977fcbb694cccf0f9628fecfe47634b68e0ab31ad97492ede35942d723e239b6242b4c8a11abcebb75046858f4a87a78a7f26fcc265c014
SSDEEP

98304:s95xaGEdoLzOZc74fNGhIpLc9pIvsGSNC3ZxB8:lGgonacMfKIJc9p4CCJs

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4339-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex	4339	rjfk.zlqc.gq
/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex	4365	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/rjfk.zlqc.gq/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex	4339	rjfk.zlqc.gq

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	rjfk.zlqc.gq

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	rjfk.zlqc.gq

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rjfk.zlqc.gq

rjfk.zlqc.gq
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4339
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/rjfk.zlqc.gq/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4365

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/rjfk.zlqc.gq/app_dex/classes.dex

Filesize
4.5MB

MD5
f24ce658d27b0586bcb096b2deae7538

SHA1
a85fed66d7f18b24d85b0005d839d08eaca1da9e

SHA256
b1377637888c231260b569e5ec270187494a7ee10b0b59c7ff1f7c247f099390

SHA512
9ba43600b738f678124639307bfcd692507d967f6fb3f26a93b1ff8342f067785da899b242604dba352e45eb3a6607521832df8c4d6a012b442e8d200576e1a6

Download Submit
/data/data/rjfk.zlqc.gq/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

Filesize
166KB

MD5
f75aaa920b08fa0e17bc524bcddc3747

SHA1
08b960b03fc9c3373940da5ed8ba8955f367c8de

SHA256
00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

SHA512
c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

Download Submit
/data/data/rjfk.zlqc.gq/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
16a32559ff60385966e73769320fc47a

SHA1
99dc629f36569817bcef80abdea8d21ff876d14b

SHA256
4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

SHA512
1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

Download Submit
/data/data/rjfk.zlqc.gq/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/rjfk.zlqc.gq/files/PersistedInstallation2428070283739475478tmp

Filesize
570B

MD5
c2a5519c298094e7ae706bc8e906b8de

SHA1
bfd1b9add5c648b5f014d1eb84357c099037d7a0

SHA256
29cc17a8238e5acb1bd13d61bb78a31bfba9b1353de0979bc4ab176e85dda538

SHA512
da0b1f3f7bc38fa07900f08f7fd5c143c7d6d6a7761140e3300d595b76ad25d1a3d3bc34264dd1c23c63bed962efd8528c974415f62dbf2cb3e069fde8b27caa

Download Submit
/data/data/rjfk.zlqc.gq/files/PersistedInstallation7246969340474115072tmp

Filesize
90B

MD5
ab606e58ec45f4f6dc9ef44b41edd257

SHA1
c1ea6cfc994458d32b6761ec45a788065ce1041d

SHA256
96996b7eb02b6f342c1fd36ad3c674462bbf66b08b110478b30707dab2238f3c

SHA512
ec0ff05c48badfac177744c88f70092df55d15fe9928ccdbc821a56cfea2bc34d7f33255906148430b958866143ad05e1e6f0825c9c8fb69d3a7c712bec3ccb6

Download Submit
/data/data/rjfk.zlqc.gq/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cdbc5f1c57856bb3767eba59904ac5b3

SHA1
e0f5980e4207a1e5d381442bcdfedccc4485cf39

SHA256
2d9b402576aa1fd0f5e266cfb2a7a939e60951da65110b4911bcf21d41c9b11b

SHA512
b93e431705169c458332639144905cd014de25fa5e0c81e0fc3d87787da47d98b0e76c027de0504e83e24a67dc29023f4f60245633366f1b8a49c9984a502310

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
b6eb122922ba6dc365ae2e10c61caa5f

SHA1
9970180c0da29bbdc4b679abc97f9b0696030bcb

SHA256
ef2bcddb75b67bd32e325fd7decf0a318edb91915a9f982ed9bb203558018eda

SHA512
44e8595c4a464505ba1111dba669ce1826d29aee30eb9a4beddc7ef38f9f2c3be9f90e5c5b148907232a5e8a21ba7757171c153953b435c7942dbbb81ceb0fc0

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
10ca53fe3676e0ed397e388eb8ef03f8

SHA1
56a1f563e9d84c1045c4dea4cc387f0131379b4c

SHA256
4b00cba239f1c93235efa2022899abbbce87b66bd844a3237514fd50607109cf

SHA512
1d29b696c625865d6968765c6be1f053676307517a3aa484e1a9adc31bb4773554c2307aa3441e1e29b07f039797c972f370a51caf1327985ea9103f024114c3

Download Submit
/data/data/rjfk.zlqc.gq/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
0273bb7f756ed055b025961662027ab3

SHA1
704e211c774f63bf0dafc14387ff18441ca355dd

SHA256
6843061ca46a057d53b68c5dc398ffd64a312616d3b7255ce3765bd3b1f6fb03

SHA512
726f02de267ab6a64c46477dd15c1c7ee4e792a1a0ea93ea61f16980ac4273856bb2ed5375d81fdf7df48a6650e0258978cdc275ffcd0671f1dc825b6b88821f

Download Submit
/data/user/0/rjfk.zlqc.gq/app_dex/classes.dex

Filesize
4.5MB

MD5
a1e5aa629954ba1f8fc2bddf4cb26755

SHA1
7db08ea76bcb958d35edb6321d1e5aa70daa6d1f

SHA256
f1c74b8d04abaec3b3292b5ef4e57ef320aad304f35ceb7b9756338606c72257

SHA512
9506796992fe26b5dd01e2cf433137a8567e4a6e9c9af3b96eda54a1a9a8d57a25fcd100681a596e1647fddee288ace3aff924875c301e4fc35971a3f0c4181a

Download Submit