soumnibot | ac569ea39187a9c6cd107c700200ae417eae7b8daa208c1ac8977d8dd83c70fa

Analysis

max time kernel
1s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
23/01/2025, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac569ea39187a9c6cd107c700200ae417eae7b8daa208c1ac8977d8dd83c70fa.apk
Size

2.1MB
MD5

78e3ca32c8382f398bdd4c5c2a9ceb90
SHA1

7a35221343f0f86ae6d5a048c0f7eabdf3d6f57a
SHA256

ac569ea39187a9c6cd107c700200ae417eae7b8daa208c1ac8977d8dd83c70fa
SHA512

e0b158dc95b28553367ace49ed4351e21426ce6628521e8d930b5730b2657e2932112a0bbd7c754df9097c5bfb2baf316b4de89d1ab3332908b363db2134892c
SSDEEP

49152:73JnQIjWzgjaJtBCIznEvJnpp1JWu0wQJb2FIxAgSmS:79QHgctBCIgvR1cwQdOGS

Score

10^/10

soumnibot banker evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4597-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/qdw0d.rv8ap.jirgs/[email protected]	4597	qdw0d.rv8ap.jirgs
/data/user/0/qdw0d.rv8ap.jirgs/[email protected]	4597	qdw0d.rv8ap.jirgs

qdw0d.rv8ap.jirgs
1⤵
- Loads dropped Dex/Jar
PID:4597

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/qdw0d.rv8ap.jirgs/.jiagu/libjiaguv1.so

Filesize
226KB

MD5
c622a3115c4eb6a38699b1f1b22d17fc

SHA1
7d5d60e0981e259699257b76ca448b87d13ce2b2

SHA256
b78cab422f8fa05e94aa02f90b582376a357042bf2bae2fa529a3c873c2a675b

SHA512
35f19af4769a7f89abf067509196f43872a744839e1dc52fb38de58f57ba640e8d811e236135fd669a13b6ba7355de95ba292cb8540835cf1f0f27aef5e67840

Download Submit
/data/data/qdw0d.rv8ap.jirgs/oat/x86_64/[email protected]

Filesize
353B

MD5
a5fef345ce38ef6e52dc21c838ae9d50

SHA1
42776999a96cc5bd712d888796fe2c02d2a27864

SHA256
647f445090a249165ab8947bf6db8efe1131c1f2c9ef98feafa3c89556f09251

SHA512
46120941efb9d9167cb89ca259be9f43a9ce02b0a9dc30bbfae4c624588f1e676553362cbc7ee8f5a6068e5563455e5deab530119ebcd4da308d8d0b8b8e3e0e

Download Submit
/data/user/0/qdw0d.rv8ap.jirgs/[email protected]

Filesize
2.2MB

MD5
45c434bf541685540692c68dd602b859

SHA1
d340fc49d6b7be22711faff389ca8b3da07989b5

SHA256
d7b036306a9297ff29e5d0d024e3097eed4e94b92aa7d265b9fc075d1afb41c2

SHA512
d39b11d9a6675e9120db8d06da92d44d29b6b3c59f35c4a536dfdf1eaabc45bf1e44a3f5879a629828e63f3f81cb8c021f1d8af07515edb818a6a3c62d83d493

Download Submit