brata | 7781616169[.]zip

General

Target
7781616169.zip
Size 2.0MB
Sample220805-vtedkachen
SHA256 6a738881c64ca1af12802d01133b71d129ccb2bb748bc5f6ff23429d77422bb2
MD5 c2589f6c46741e6919deb0ecbbd88c43
SHA1 9037569684c29366143e546883a135764a247857
SHA512 ed4a5aa8d7d4880869867eb4e3b92d44d3e367d7a7c059b5b07e224c7356e02b5cab826083c04c4a7e146db4882ccd2b3e14f7a8eeef21544ae8be22dcd7597e
SSDEEP 49152:NHUHE1s72QxMfKrKV7jl8lpEWnxNsEOpECyXoM:dUk1sZxMGlCWnxNhU7yXoM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

brata

Malware Config

Signatures

Brata family
brata

Brata payload 1 IoCs

resource	yara_rule
sample	family_brata4

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

File Explorer

7781616169.zip

.zip 2.0MB
d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e

.apk 2.2MB

7781616169.zip

SHA256 6a738881c64ca1af12802d01133b71d129ccb2bb748bc5f6ff23429d77422bb2
MD5 c2589f6c46741e6919deb0ecbbd88c43
SHA1 9037569684c29366143e546883a135764a247857
SHA512 ed4a5aa8d7d4880869867eb4e3b92d44d3e367d7a7c059b5b07e224c7356e02b5cab826083c04c4a7e146db4882ccd2b3e14f7a8eeef21544ae8be22dcd7597e
SSDEEP 49152:NHUHE1s72QxMfKrKV7jl8lpEWnxNsEOpECyXoM:dUk1sZxMGlCWnxNhU7yXoM
MD5 SHA1 SHA512 SSDEEP

Brata payload

Password

infected

d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e

SHA256 d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e
MD5 c863eac37df1b80de26334d6dfce8aec
SHA1 ddd76dd8e4de655d7d67aacbec36694e8e221612
SHA512 cb376ddf558f47d92a53fd281600f2bf9ff760daf2fd53e20ceb1c941d5d3a400d8717a0588fa8676fc6a8fe4beee5d417fdc1581e587631bd3913bed0264135
SSDEEP 49152:B/tI21hWuaWaTxuh0J9ZGc1d30O8xz1EUQq28I3Plb5:JtI21hWua7TxSKVwO4+598Y95
MD5 SHA1 SHA512 SSDEEP

android

Brata payload

com.psiphon3

7781616169.zip

d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

anywheresoftware.b4a.samples.httputils2.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Signatures

File Explorer

7781616169.zip

d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

anywheresoftware.b4a.samples.httputils2.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider