soumnibot | a7bd94af244c7ee460b4b477c565d5d8730a914b723552da0f241e87f2881839

Analysis

max time kernel
5s
max time network
133s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
09/12/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7bd94af244c7ee460b4b477c565d5d8730a914b723552da0f241e87f2881839.apk
Size

2.1MB
MD5

4f5cdb35808af95cb8e5f7d46596b26f
SHA1

536f9d45345518b3f9768a6098189ea0e7d41621
SHA256

a7bd94af244c7ee460b4b477c565d5d8730a914b723552da0f241e87f2881839
SHA512

edd55460c30102c13e21232025e592a8972620ffa99d196d1ddd134958dbbf14040f0c4ea0c538187a81e6d6d0798650a2b3d044da046b85956b20284a83984c
SSDEEP

49152:bgSrWQbMFXgciEbU2/nTZef6d1TmalSIe+fdym:TWQQRFikU2/T0f6jTFSIdt

Score

10^/10

soumnibot banker evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4349-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/d4evu.bhwl0.mgvdr/[email protected]	4349	d4evu.bhwl0.mgvdr
/data/user/0/d4evu.bhwl0.mgvdr/[email protected]	4349	d4evu.bhwl0.mgvdr

d4evu.bhwl0.mgvdr
1⤵
- Loads dropped Dex/Jar
PID:4349

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/d4evu.bhwl0.mgvdr/.jiagu/libjiaguv1.so

Filesize
226KB

MD5
dbf6186a7e1151fb8287fd7e34e735c4

SHA1
70805ef97d21e8eb80965750f4679f4af212dd85

SHA256
35de124826257236a8788c1903459b04f698602a128530f6735d33836ac9cccf

SHA512
c30ffac26d9ae72619c88d0cb90212ceb3fe6884dc4013b391ae86c78257843c2229559c74e98bc664119731d2d0d41eb90170af52f65fcb154e6295e093e1c0

Download Submit
/data/data/d4evu.bhwl0.mgvdr/oat/x86_64/[email protected]

Filesize
61KB

MD5
5079e620af12e997c8ca8cd3b4e35e72

SHA1
64f821622582e6ff9e61a9e2336dcefdbce6b711

SHA256
ebfadbd5cd3ab6fc47c0d71109c58f1b0e366b1b7f893f22a3e941355462ef57

SHA512
ba7015482000a8b1ae1ef47c9bf9152571a1302795bbc45d4c781bd8ad28d71de582beedecbb79f34bbc852e126115ff22d0f199dade9cb560de7da1562aadf1

Download Submit
/data/user/0/d4evu.bhwl0.mgvdr/[email protected]

Filesize
2.2MB

MD5
a93faa2cb9d4331c82952822a5a62fef

SHA1
703b983263366e2dc03c34f5f6040669b853604b

SHA256
f008903f9fe6ae899fffeeebd6219cead925c7f65b61e9c5ef74783ef6110ca6

SHA512
cfb0738f48126d8f807fe20a82a08382198aec65bbb471f9a77cc843e5004181da64c725426cd5d4f0389c76c94ce520991688f2cf4f0018c4be86ba61283557

Download Submit