brata | f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

General

Target
f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f
Size 3.0MB
Sample220731-lkmtxaaae2
SHA256 f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f
MD5 d7e2fff32d4386cf1d6981fa2416f322
SHA1 4695a3986e6ed367cdc1d22997f32ea9d8293243
SHA512 ad87d65b497e52a21bfb3b9f028e9b4a910e4070528e0b5b0e5ffd4b7726d825aa45c516f3c6980a36357d414a6e333683b592159296c0afee0c1ba6b0fbd51e
SSDEEP 49152:Hle12xwAcVgVJuZ6/TZn0IGxdSzsbFqM68jd77NCisiX3iR6VTfEZ:Hlw2xX2Z6/TZ03Szsbz68jBNCHW7C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

brata

Malware Config

Signatures

Brata family
brata

Brata payload 1 IoCs

resource	yara_rule
sample	family_brata4

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

File Explorer

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

.apk 3.0MB

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

SHA256 f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f
MD5 d7e2fff32d4386cf1d6981fa2416f322
SHA1 4695a3986e6ed367cdc1d22997f32ea9d8293243
SHA512 ad87d65b497e52a21bfb3b9f028e9b4a910e4070528e0b5b0e5ffd4b7726d825aa45c516f3c6980a36357d414a6e333683b592159296c0afee0c1ba6b0fbd51e
SSDEEP 49152:Hle12xwAcVgVJuZ6/TZn0IGxdSzsbFqM68jd77NCisiX3iR6VTfEZ:Hlw2xX2Z6/TZ03Szsbz68jBNCHW7C
MD5 SHA1 SHA512 SSDEEP

android

Brata payload

zuera.gotc.serko

Android Permissions

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

Permissions

android.permission.READ_PHONE_STATE

android.permission.WRITE_SETTINGS

android.permission.VIBRATE

android.permission.BIND_WALLPAPER

android.permission.SET_WALLPAPER

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.REBOOT

android.permission.DUMP

android.permission.ACCESS_NETWORK_STATE

android.permission.BATTERY_STATS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.GET_TASKS

android.permission.READ_SMS

android.permission.CAMERA

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.CALL_PHONE

android.permission.RECEIVE_SMS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.USE_BIOMETRIC

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

.main

.rocho

.azulinha

.lilas

.amarelinha

.bolsonaro

.origemn

.vermelha

.verlaietivity

.main2

.itaucardbom

.canairizinha

.cameraz

.activityruntimep

.progertormidia

.starter

.startertwo

.execucoes

.unlock

.service1

.service2

.service3

anywheresoftware.b4a.samples.httputils2.httputils2service

.starter$starter_BR

.startertwo$startertwo_BR

.execucoes$execucoes_BR

.unlock$unlock_BR

.service1$service1_BR

.service2$service2_BR

.service3$service3_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

Sharing

General

Malware Config

Signatures

File Explorer

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f

.main

.rocho

.azulinha

.lilas

.amarelinha

.bolsonaro

.origemn

.vermelha

.verlaietivity

.main2

.itaucardbom

.canairizinha

.cameraz

.activityruntimep

.progertormidia

.starter

.startertwo

.execucoes

.unlock

.service1

.service2

.service3

anywheresoftware.b4a.samples.httputils2.httputils2service

.starter$starter_BR

.startertwo$startertwo_BR

.execucoes$execucoes_BR

.unlock$unlock_BR

.service1$service1_BR

.service2$service2_BR

.service3$service3_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

Android Permissions

f1dbed595f4bbbf0106f1984f63cbde23650cd8ba5c50c2da92a2e8adfa9746f