General

  • Target

    NEAS.7948397b18f22038a32952a9f2477fb6b784f8f129d27de516f10478559f10e7apk.zip

  • Size

    2.6MB

  • MD5

    fba5d476993c7418b0bc49500c7f0e8b

  • SHA1

    0dc013f26807b4e7cca1b11af8ff3b152af055d1

  • SHA256

    7948397b18f22038a32952a9f2477fb6b784f8f129d27de516f10478559f10e7

  • SHA512

    5ec0b150ce61d0c57964a2dbd44a55f5c1d6fb4ec0acb9f234c61f70f1e9400663184d8d187b72e05b1cfef1a0b1d9c4ffb215fc5357e836017dca80ac913f6b

  • SSDEEP

    49152:bE7pf3v5k6id5REEjp/UIbeQCfC6ud8p26BZ6qGF9K9/C7iPJMTW8X:bOfejRlTbeHfCRd8p049/CqSC8X

Score
10/10

Malware Config

Signatures

  • Irata family
  • Irata payload 2 IoCs
  • Requests dangerous framework permissions 5 IoCs

Files

  • NEAS.7948397b18f22038a32952a9f2477fb6b784f8f129d27de516f10478559f10e7apk.zip
    .apk android

    vip.app.com

    .main


  • layout.bal
  • main.bal
  • port.txt

Android Permissions

NEAS.7948397b18f22038a32952a9f2477fb6b784f8f129d27de516f10478559f10e7apk.zip

Permissions

vip.app.com.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.INTERNET

android.permission.READ_SMS

android.permission.VIBRATE

android.permission.POST_NOTIFICATIONS

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

com.google.android.gms.permission.AD_ID

vip.app.com.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.READ_CONTACTS