Resubmissions

11/07/2023, 18:01

230711-wlwhjsbd6z 10

11/07/2023, 17:47

230711-wcvvnabd4s 10

General

  • Target

    EdalatHamrah7.2.apk

  • Size

    2.8MB

  • MD5

    fa84264ee063689f03ebdb2b86958235

  • SHA1

    551239ef5775453afe819c33b257cc3aeeee559e

  • SHA256

    ae556cb517a71d45a4ae6f0ff6a4d067aadc5388dc57e16dcdbae2db97fcea76

  • SHA512

    394ec1c1d13c13aedec2c5c1764cedf49712a18023ac16cdb925ac2cca07b2e4c74cd105d3f8756eb9e695885114ae74d9613a27c633227326049a37e4a0e89c

  • SSDEEP

    49152:hl56JUGZieeiaEePAxwEFOPPF3mZqev2YvaViFgRKZTI/1JwNEHyRj8hnHULQYHO:/57GZieeioAx/EPRmZqev/Rxu/1Jwu+W

Score
10/10

Malware Config

Extracted

Family

irata

C2

http://accorg.site:1023/api

http://accorg.site:1023/url

Signatures

  • Irata family
  • Requests dangerous framework permissions 6 IoCs

Files

  • EdalatHamrah7.2.apk
    .apk android

    com.pixo.rat

    .main


  • lmain.bal

Android Permissions

EdalatHamrah7.2.apk

Permissions

com.pixo.rat.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.INTERNET

android.permission.WRITE_SETTINGS

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

com.google.android.gms.permission.AD_ID

com.pixo.rat.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.RECEIVE_SMS

android.permission.READ_CONTACTS

android.permission.CALL_PHONE

android.permission.READ_CALL_LOG

android.permission.REQUEST_DELETE_PACKAGES

android.permission.DELETE_PACKAGES

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.ACCESS_WIFI_STATE