General

  • Target

    EDALAT.apk

  • Size

    3.3MB

  • MD5

    3c3be58d9d278ce54efc76401c10ded4

  • SHA1

    6ccd517b4f136032e0dc0f84947ae54f1f421dba

  • SHA256

    4f4cfd4a601f3d3800fd981e9e3516b208ec4d986276d61dbef46f8e72831816

  • SHA512

    c453e9daef47e62ec63988ae61f81d4814489c481654110e60b8bb3c16b2af3c4d42b535cf406b4f7740fcfc0f11c1f703aa35bb5ad6877fb444d1d0b81a2827

  • SSDEEP

    98304:d05D6efffnRcj7jGPJqj5GuRwzeW+u3sePA8r0Kd:dEXcXgYRwzeX+A8r3d

Score
10/10

Malware Config

Extracted

Family

irata

C2

https://newidbot.tk

Signatures

  • Irata family
  • Irata payload 1 IoCs
  • Requests dangerous framework permissions 4 IoCs

Files

  • EDALAT.apk
    .apk android

    ir.shz.shzkisi

    .main


  • Toxic-Port.txt
  • lmain.bal
  • url.txt

Android Permissions

EDALAT.apk

Permissions

android.permission.INTERNET

android.permission.READ_SMS

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

ir.shz.shzkisi.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.SEND_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_SMS

android.permission.READ_CONTACTS