irata | f8cf53124194268ff601f364d00cd52c[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f8cf53124194268ff601f364d00cd52c.bin
Size

2.4MB
MD5

a7e7abf157b468df3354894af805c7ed
SHA1

b4eeb829479e35dda498f4be0d9b06463da1a24f
SHA256

8e9fc380085d24ebf5a8083e25e055dd4bd68565b7ec493f57c34e81645543ee
SHA512

a08f5a282b5d4482292d04e2fba007e6204dc8e187d1bc1cbbccc8046f71b84d93b6a9e2083311fb6a24a8b8ed81cbaf88ed89e1a88b707dd43a4b4423d39a5f
SSDEEP

49152:GWqkFt9zhrtik1LawTD5GrG/Ks41kitRZc2AqkpRfSN9X2BWHHTG:GEf9rtVHGr6Ks4m4x2Rf0zHTG

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

Files

f8cf53124194268ff601f364d00cd52c.bin
.zip

Password: infected
85a508d7a33f455aec8a7f735630b27ef6d2963a0d7469801979d6f06e1742e6.apk
.apk android

com.rez.ir

.main

Activities

.main

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.rez.ir.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_SMS
android.permission.READ_CONTACTS

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION

.starter$starter_BR

android.intent.action.BOOT_COMPLETED

.firebasemessaging$firebasemessaging_BR

android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SMS_RECEIVED

Services

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

anywheresoftware.b4a.objects.FirebaseNotificationsService

com.google.firebase.MESSAGING_EVENT