General

  • Target

    KissLand.apk

  • Size

    3.5MB

  • MD5

    7ca82baa3e7eddce41a25bf071216d1b

  • SHA1

    fc1d45f0f81b6da49dd57d4342d5510dff5dbee7

  • SHA256

    91a2d790366e433f18036a85d935d7e628c652c35b00427f6ef809fa9ec1f69e

  • SHA512

    3be8f78b283cedd0857673daa05bccf51b12940366248a2ab2ad389e134f0348dbf5425331cb5ea86f1e714bff605604a3c4c94f9c493424a9cb26761131c12c

  • SSDEEP

    98304:7SP56efffnRcj7jGPJqRvlZ+OSxM/9nLPDqyMNE:7SRXcXgqaOSxM/FPuyMO

Score
10/10

Malware Config

Extracted

Family

irata

C2

https://selfam.dachhost

Signatures

  • Irata family
  • Irata payload 2 IoCs
  • Requests dangerous framework permissions 4 IoCs

Files

  • KissLand.apk
    .apk android

    ir.shz.shzkisi

    .main


  • Toxic-Port.txt
  • lmain.bal
  • url.txt

Android Permissions

KissLand.apk

Permissions

android.permission.INTERNET

android.permission.READ_SMS

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

ir.shz.shzkisi.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.SEND_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_SMS

android.permission.READ_CONTACTS