soumnibot | 4f7a1cb3091585380534577b614fcb8eb60f4d0d9a20d6badaba8dcdb356b315

Analysis

max time kernel
149s
max time network
156s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22-12-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f7a1cb3091585380534577b614fcb8eb60f4d0d9a20d6badaba8dcdb356b315.apk
Size

4.4MB
MD5

420c8785707c35dd9ccd0ad194d6efd4
SHA1

437c791abab6fae06ec8188a1d494142b02c393a
SHA256

4f7a1cb3091585380534577b614fcb8eb60f4d0d9a20d6badaba8dcdb356b315
SHA512

7756a1f557da055a0d77c40b11e6e115e0fcb62707067e4ee8409e7354980dc11630f05dd2bac799e4d48bfbdc8af4547927edfa0bc051568a28c86020128566
SSDEEP

98304:OcSEGiIH9Q6ZB/cVicj3ab2BQlmLDOLqS73nE4J6jrrV:OcPGj9N/c3imLDOLqCdJu

Score

10^/10

soumnibot banker discovery evasion infostealer persistence trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5060-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/bai.shan.shui/[email protected]	5060	bai.shan.shui
/data/user/0/bai.shan.shui/[email protected]	5060	bai.shan.shui

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	bai.shan.shui

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	bai.shan.shui

bai.shan.shui
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5060

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/bai.shan.shui/.jiagu/libjiaguv1.so

Filesize
250KB

MD5
29f77b0cb6556577977e910a8c236edc

SHA1
7b3e8796d51439a738011a6c40cd614b90c542ab

SHA256
d7a458c582cbba02ac4237a81e95c270572b2e168ed8b5b70191feba0ebf7fe8

SHA512
5797d366d2aded5afa0d1a67f17a5bf7e7798cbb8d380978d93b22232656ce9b89f46c75e68d9dd52ccc11e8d4af3cdd3793e83240bc2b8007c825966271b3ef

Download Submit
/data/data/bai.shan.shui/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/user/0/bai.shan.shui/[email protected]

Filesize
1.8MB

MD5
dc4eb6b2e4b7c4c25d8badddd60ed3c0

SHA1
0dca2a4b0ba49145d5f319e7e43ba02c14760fb9

SHA256
e77f2ab5e5e73f0c7ecfb62a8181c8e004bf6b68b4826f588cae23b1a172912c

SHA512
f6813c82188acbbadde1ff473632cf2f62063a5c9357a1a80ad66664d7157e63a95fc8fb1fade18a812a75b0b3056760d89e10dcf2ef8f406c890313989a753d

Download Submit