Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-12-2024 22:05

General

  • Target

    659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e.apk

  • Size

    4.4MB

  • MD5

    370db6009260bf38d7cb5d95705f3e48

  • SHA1

    7a7abd4cf29698e5609d80c484e3811ace9f8578

  • SHA256

    659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e

  • SHA512

    60e20eddbc44a13251709d6aa57cdf736efd0c67a6f56b5b8cdac6c2ece211c442b87ec24c06c3af363614fe8f10e00c225a910b3e30c404903e8c8b53966d4e

  • SSDEEP

    98304:OcSEGiIH9Q6ZB/cVicj3ab2BQlmLDOLqS73nE4J6jrrF:OcPGj9N/c3imLDOLqCdJi

Malware Config

Signatures

  • Android SoumniBot payload 1 IoCs
  • SoumniBot

    SoumniBot is an Android banking trojan first seen in April 2024.

  • Soumnibot family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • bai.shan.shui
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4241

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/bai.shan.shui/.jiagu/libjiaguv1.so

    Filesize

    222KB

    MD5

    e0cdfe09bad49823017b8df7dc1e8f13

    SHA1

    e94f612851dd5114c6609189aa3c985893bc5c41

    SHA256

    5bf5f10931feefdabb6dbf9e39208c99225237b97cab7d278f6f2fecef81ae35

    SHA512

    d1258bb156caebbdabc0feb8676ffee86dcc4c5b2a0c1b728b485422feec2c4a167ba702af47783d6affb018c95b533a45c8642b730de0cc84994077219e3b2d

  • /data/data/bai.shan.shui/files/mmkv/mmkv.default

    Filesize

    4KB

    MD5

    620f0b67a91f7f74151bc5be745b7110

    SHA1

    1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

    SHA256

    ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

    SHA512

    2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

  • Anonymous-DexFile@0xd3aae000-0xd3c7f770

    Filesize

    1.8MB

    MD5

    dc4eb6b2e4b7c4c25d8badddd60ed3c0

    SHA1

    0dca2a4b0ba49145d5f319e7e43ba02c14760fb9

    SHA256

    e77f2ab5e5e73f0c7ecfb62a8181c8e004bf6b68b4826f588cae23b1a172912c

    SHA512

    f6813c82188acbbadde1ff473632cf2f62063a5c9357a1a80ad66664d7157e63a95fc8fb1fade18a812a75b0b3056760d89e10dcf2ef8f406c890313989a753d