Analysis
-
max time kernel
149s -
max time network
159s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
22-12-2024 22:05
Behavioral task
behavioral1
Sample
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e.apk
Resource
android-x86-arm-20240624-en
General
-
Target
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e.apk
-
Size
4.4MB
-
MD5
370db6009260bf38d7cb5d95705f3e48
-
SHA1
7a7abd4cf29698e5609d80c484e3811ace9f8578
-
SHA256
659769a2334d0f9aea8cae732b9f9dd2834ede265a3a042d67deac1a8e75c51e
-
SHA512
60e20eddbc44a13251709d6aa57cdf736efd0c67a6f56b5b8cdac6c2ece211c442b87ec24c06c3af363614fe8f10e00c225a910b3e30c404903e8c8b53966d4e
-
SSDEEP
98304:OcSEGiIH9Q6ZB/cVicj3ab2BQlmLDOLqS73nE4J6jrrF:OcPGj9N/c3imLDOLqCdJi
Malware Config
Signatures
-
Android SoumniBot payload 1 IoCs
resource yara_rule behavioral2/memory/4779-0.dex family_soumnibot -
SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
-
Soumnibot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/bai.shan.shui/[email protected] 4779 bai.shan.shui /data/user/0/bai.shan.shui/[email protected] 4779 bai.shan.shui -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo bai.shan.shui -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS bai.shan.shui
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD529f77b0cb6556577977e910a8c236edc
SHA17b3e8796d51439a738011a6c40cd614b90c542ab
SHA256d7a458c582cbba02ac4237a81e95c270572b2e168ed8b5b70191feba0ebf7fe8
SHA5125797d366d2aded5afa0d1a67f17a5bf7e7798cbb8d380978d93b22232656ce9b89f46c75e68d9dd52ccc11e8d4af3cdd3793e83240bc2b8007c825966271b3ef
-
/data/user/0/bai.shan.shui/[email protected]
Filesize1.8MB
MD5dc4eb6b2e4b7c4c25d8badddd60ed3c0
SHA10dca2a4b0ba49145d5f319e7e43ba02c14760fb9
SHA256e77f2ab5e5e73f0c7ecfb62a8181c8e004bf6b68b4826f588cae23b1a172912c
SHA512f6813c82188acbbadde1ff473632cf2f62063a5c9357a1a80ad66664d7157e63a95fc8fb1fade18a812a75b0b3056760d89e10dcf2ef8f406c890313989a753d
-
Filesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d