Analysis
-
max time kernel
149s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
22-12-2024 22:05
Behavioral task
behavioral1
Sample
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e.apk
Resource
android-x86-arm-20240624-en
General
-
Target
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e.apk
-
Size
4.4MB
-
MD5
370db6009260bf38d7cb5d95705f3e48
-
SHA1
7a7abd4cf29698e5609d80c484e3811ace9f8578
-
SHA256
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e
-
SHA512
60e20eddbc44a13251709d6aa57cdf736efd0c67a6f56b5b8cdac6c2ece211c442b87ec24c06c3af363614fe8f10e00c225a910b3e30c404903e8c8b53966d4e
-
SSDEEP
98304:OcSEGiIH9Q6ZB/cVicj3ab2BQlmLDOLqS73nE4J6jrrF:OcPGj9N/c3imLDOLqCdJi
Malware Config
Signatures
-
Android SoumniBot payload 1 IoCs
resource yara_rule behavioral1/memory/4241-0.dex family_soumnibot -
SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
-
Soumnibot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process Anonymous-DexFile@0xd3aae000-0xd3c7f770 4241 bai.shan.shui -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo bai.shan.shui -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS bai.shan.shui -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver bai.shan.shui
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD5e0cdfe09bad49823017b8df7dc1e8f13
SHA1e94f612851dd5114c6609189aa3c985893bc5c41
SHA2565bf5f10931feefdabb6dbf9e39208c99225237b97cab7d278f6f2fecef81ae35
SHA512d1258bb156caebbdabc0feb8676ffee86dcc4c5b2a0c1b728b485422feec2c4a167ba702af47783d6affb018c95b533a45c8642b730de0cc84994077219e3b2d
-
Filesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
-
Filesize
1.8MB
MD5dc4eb6b2e4b7c4c25d8badddd60ed3c0
SHA10dca2a4b0ba49145d5f319e7e43ba02c14760fb9
SHA256e77f2ab5e5e73f0c7ecfb62a8181c8e004bf6b68b4826f588cae23b1a172912c
SHA512f6813c82188acbbadde1ff473632cf2f62063a5c9357a1a80ad66664d7157e63a95fc8fb1fade18a812a75b0b3056760d89e10dcf2ef8f406c890313989a753d