.main
android.intent.action.MAIN
Resubmissions
29-08-2022 20:20
220829-y4ec4affc4 10General
-
Target
gen_signed3.apk
-
Size
3.3MB
-
MD5
67bc18eeaca9ec3254394dcce2e3b0a4
-
SHA1
ef0a17ed409896959fb93e5f6d62c14e3ba5422f
-
SHA256
c160f3d1d4559482aa8f614e74c1cbd33dcebc2f7be5df622ee1ef3cfb052593
-
SHA512
378c4e513c2831ba7c7136390c82c21a07fcd55a6a5b61bf35c95bbcc4293f1c124faf911af56951b96201090998a2352f3ad39af0a0d552bd35fcd65e46e266
-
SSDEEP
98304:IEVF6aL7fDW3v0AMYfccAAmonM9QF7FuYN8p5HWVrziP:I46x3vKcAqnXJCp5292P
Score
10/10
Malware Config
Extracted
Family
irata
C2
https://xn--mgba8ac3gkj19e.ga
Signatures
-
Irata family
-
Irata payload 1 IoCs
resource yara_rule sample family_irata -
Requests dangerous framework permissions 4 IoCs
description ioc Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS
Files
-
gen_signed3.apk.apk android
ir.shz.shzkisi
.main
Activities
Permissions
android.permission.INTERNET
android.permission.READ_SMS
android.permission.VIBRATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
ir.shz.shzkisi.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_SMS
android.permission.READ_CONTACTS
Receivers
com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver
com.android.vending.INSTALL_REFERRER
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION
.starter$starter_BR
android.intent.action.BOOT_COMPLETED
.firebasemessaging$firebasemessaging_BR
android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SMS_RECEIVED
Services
com.google.firebase.iid.FirebaseInstanceIdService
com.google.firebase.INSTANCE_ID_EVENT
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
anywheresoftware.b4a.objects.FirebaseNotificationsService
com.google.firebase.MESSAGING_EVENT
Android Permissions
gen_signed3.apk
Permissions
android.permission.INTERNET
android.permission.READ_SMS
android.permission.VIBRATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
ir.shz.shzkisi.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_SMS
android.permission.READ_CONTACTS