brata | a515689b1af72606064d32894f00f9b03594ad69cc5b311545bac5af3b81a43a

Analysis

max time kernel
1758910s
max time network
166s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
29/05/2023, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A515689B1AF72606064D32894F00F9B03594AD69CC5B311545BAC5AF3B81A43A.apk
Size 3.7MB
Sample230529-xehtjsdb23
SHA256 a515689b1af72606064d32894f00f9b03594ad69cc5b311545bac5af3b81a43a
MD5 e594324a6a2fd123b38ad4e53b487fc7
SHA1 c078793a90ec1f4ceafa184ae7485285e981c6ab
SHA512 24428989f7caa2c5f60520379dde5e38a2852401f592a30f86affe786499e12a3d8d3b8f9f5ee4a9a1f8d73940e37a262db173bf59bb37c880ef8546f4f7947f
SSDEEP 98304:KHQMjUMf/fBaGIsavzCPG2fnXz1Dy7Wlwn0dAiRaH6:KwMjUofBbpD47Wvd/0a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

brata banker infostealer rat trojan

Malware Config

Signatures

Brata
Brata is a banking trojan malware first seen in 2019.
banker trojan infostealer rat brata

Brata payload 6 IoCs

resource	yara_rule
behavioral3/files/4612-0.dat	family_brata2
behavioral3/files/4612-0.dat	family_brata3
behavioral3/memory/4612-0.dex	family_brata2
behavioral3/memory/4612-0.dex	family_brata3
behavioral3/memory/4612-1.dex	family_brata2
behavioral3/memory/4612-1.dex	family_brata3

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	terror.net.sucess

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	terror.net.sucess

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/terror.net.sucess/app_ded/zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex	4612	terror.net.sucess
/data/user/0/terror.net.sucess/app_ded/zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex	4612	terror.net.sucess

terror.net.sucess
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex

Path /data/user/0/terror.net.sucess/app_ded/zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex
Size 4.0MB
SHA256 3a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
MD5 7ac2fd295f998b86ee07e6cebadd560d
SHA1 8127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA512 46117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
SSDEEP 49152:RT4LmIgIfYhrtcmxK62coVytwm8LeH7LQfmJe3pnvzmMKz6CiaO:xzWmxK62CTH7doszWaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex

Path /data/user/0/terror.net.sucess/app_ded/zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex
Size 4.0MB
SHA256 3a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
MD5 7ac2fd295f998b86ee07e6cebadd560d
SHA1 8127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA512 46117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
SSDEEP 49152:RT4LmIgIfYhrtcmxK62coVytwm8LeH7LQfmJe3pnvzmMKz6CiaO:xzWmxK62CTH7doszWaO
MD5 SHA1 SHA512 SSDEEP

Download

zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex

Path /data/user/0/terror.net.sucess/app_ded/zkFlZYH0ewsYcUQUKy4UbSV5SjsMGRIB.dex
Size 4.0MB
SHA256 3a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
MD5 7ac2fd295f998b86ee07e6cebadd560d
SHA1 8127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA512 46117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
SSDEEP 49152:RT4LmIgIfYhrtcmxK62coVytwm8LeH7LQfmJe3pnvzmMKz6CiaO:xzWmxK62CTH7doszWaO
MD5 SHA1 SHA512 SSDEEP

Download

_trv

Path /data/user/0/terror.net.sucess/files/_trv
Size 12B
SHA256 dacfe86fd73d7f9ff41e66a923211c722392d0fa0b838b9a6bfcb0d0e45379d4
MD5 abdbb534c848c7edfb4a407c25b29902
SHA1 62380bdc3037cb5df6c3fb780aaf53073506ba31
SHA512 506edaee43849f8ee043930f13b45f53b80d783bb9fa1b9393fe32e0ddea61f5cb31a57d4d1b811a0d2fc6d15dcc0a8f7b1aedd288af328e032ed25884c14bbd
MD5 SHA1 SHA512

Submit Download

a11y

Path /data/user/0/terror.net.sucess/files/a11y
Size 8B
SHA256 cde0fb0dec1400c54a0f7e7eafa73624c53e4da258bbd34b3380a0defeba95c1
MD5 2e5d8aa3dfa8ef34ca5131d20f9dad51
SHA1 3cc1d5a427a45820b04fe30f78a972b784952460
SHA512 a0527c1de9df8c529337f73be73cf98fcde155fcf00c7522f67a4a6298b52853d9767815d8811c2a7e5e829871a5dea9174b2b7e90fb7c98a62467240dd78434
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads