Analysis Overview
SHA256
27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
Threat Level: Known bad
The file 27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17 was found to be: Known bad.
Malicious Activity Summary
Irata family
Irata payload
Acquires the wake lock
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data)
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-23 13:57
Signatures
Irata family
Irata payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-23 13:57
Reported
2023-12-26 23:51
Platform
android-x86-arm-20231215-en
Max time kernel
2827636s
Max time network
128s
Command Line
Signatures
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
ir.online.afragroup
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | sdk.cheshmak.me | udp |
| GB | 172.217.16.238:443 | tcp | |
| US | 1.1.1.1:53 | nayrica.com | udp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.14:443 | android.apis.google.com | tcp |
| US | 67.225.218.22:443 | nayrica.com | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
Files
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | a484f1acfa59ac2d8e207806168cb552 |
| SHA1 | 83f36d45fa77dd7068475539ae325fb1b223b20b |
| SHA256 | 003bba0f3c6dc9c3552b8030c0fdc4eef2227caac99e92a66821cd875c8df981 |
| SHA512 | c4ca51a0ce96c09cde1e8473757b7cf0b758e94e0b48c38154ea6bdd337bae32ee2eec0eb0293a16fe649d160345ee8a8e2af8ce4188aee30950d1a5a29a34c2 |
/data/data/ir.online.afragroup/databases/db_default_job_manager
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/ir.online.afragroup/databases/db_default_job_manager-shm
| MD5 | cf845a781c107ec1346e849c9dd1b7e8 |
| SHA1 | b44ccc7f7d519352422e59ee8b0bdbac881768a7 |
| SHA256 | 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7 |
| SHA512 | 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612 |
/data/data/ir.online.afragroup/databases/db_default_job_manager-wal
| MD5 | ae1be1a65fdbaea9ba22b1e6a5325b60 |
| SHA1 | 0c20ad2ecb3e7bacbc2dfd302832a0e970b93b7c |
| SHA256 | 2605c74cc429977e9726cc1a95f8517a7fe7544841c9701ab622b1c605c7dba3 |
| SHA512 | 5dc297ebff1f7b833ec5f8fdccffbab63518ccf31f35f7e19c80b64048ea600c17344cb95cb9d4eda869d112acd7ccc22a359f7a76434f23b4832d6e7ab13837 |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/fc35aa2f-7037-4a88-b677-828fbd51c51f.jobs
| MD5 | 90f2c078efc9019bf8e6b2e8aea33015 |
| SHA1 | ee5c35cc2b5766222f7241bef3fe58c71e58b970 |
| SHA256 | 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee |
| SHA512 | 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/042b6b9e-3367-41fe-ac5c-2944f5166708.jobs
| MD5 | 427dd503a5eb5c6dea198ef16aa4f04c |
| SHA1 | c77e0224563605e6473e78123805e5ca1ae77149 |
| SHA256 | b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5 |
| SHA512 | a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670 |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | 8111622d11538afe860c367c90209b7a |
| SHA1 | 7522f65f064a7683f1177f2e65f06ad84d44152e |
| SHA256 | f98c32e78d19846fda70863d5e60599e7a0618640c0b500c01b89b48321a6e10 |
| SHA512 | 3138267eb18e09744b59d5584fadb81c663d91c691ca4e6d8bb0f04281708afbba3c0cce96586fac57ba3ad25c556ffa644596d71ccdd843f48738a9d8acb49f |
/data/data/ir.online.afragroup/databases/cheshdb-wal
| MD5 | 890c39cc661ca0a0473eda113a79bd30 |
| SHA1 | f50fa4eb022fb99a337880bdd64a5e482e6a2f1e |
| SHA256 | 96f9766e242ed948d1d82b5ef5c296ab1a19c650f26c85747fc5fcc2baf1956f |
| SHA512 | 9847a57f830bb811a4dc22a48078ee7eb51f5ad4318237f746f121bb7fcd4d9642c23ddaf1b6823157860cfdc58dfe221c8bd1119bef99c6b0b6b8b7f385c44b |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | 1a06128665daa510965dde818e86b7e2 |
| SHA1 | df34d8821785d0bda9417b8100e09cd5245a3b47 |
| SHA256 | 81715e4f925ba9bcb00aa72dd74a3a3d6e939c8bd2b1aebd9cc594b965b0a5d9 |
| SHA512 | 62a0c8f36e9859b656eda1d9a42f26ade18e0e9c5740a4201757c5df606851aa622d4f2006e2dbecc2f5a70717d8aaf9b732f0a0a95c2f3f016e7bc46211aeb1 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 7237409e0640cfab7bdbd429bf821a3b |
| SHA1 | 4c3da934842f8d4835dfe2a9c275a300e5123309 |
| SHA256 | 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa |
| SHA512 | c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | 1a6478a4833b1423d8d5e203dcb48e4f |
| SHA1 | 4836e47746c712e786d939415d7b160db18973a2 |
| SHA256 | 129eea44a66676e704014a9ef6c6c751d7c857f08d9feb294db8e3f06ac59937 |
| SHA512 | d2825267e28235f8494622e0482cf0776ff6dde9f40bb9d04a8002fd0d489f5ab3c733b097c18958453729dd31f0953d7927ffa237380732a582702d00dd88a3 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | 839c24a6d746e6a98b56736bede144da |
| SHA1 | 793cc7075583537d5f23f9b01342a4d415321aef |
| SHA256 | a2d4d67a3903768fc958650ac69d265b088795cf809ddcf77758378adc107d5e |
| SHA512 | ccf5cba31bf57283d3c9db9341c368b22e8041a7297ac72f0514095663c25b5a8395d6f234b581d66be36fdec6155340d5dd686527672326ae343fd51abe49a9 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | dd0e7ef76d6fb3583b328e09af086835 |
| SHA1 | d34031e80a75cae125dae7438e100dd4c2cbb7bf |
| SHA256 | 57b5f38a846de39d642750c9345bf013579ac5b3f74ce719efbd7846a7bac6d9 |
| SHA512 | cbad0e66dcb0d2bae38ffcb6477bbd9014751a8bb113dad4656a1241d5d52f71bbe7b7c5df16afdf97275c609e8dec888feb09d00bcb9eb54e13db18b7cb0260 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | d57b0d74bc4a840933d027d029d78986 |
| SHA1 | 5e4939a7a144e586d306780837de81ffd6cd4942 |
| SHA256 | d1c3c86876b022b2ce00bf85e302193a893719fcc27ef2a151f9b812cbd9c2ee |
| SHA512 | b9d4ff860a69d24fa76f30328f8040c7447bd181b86e88f81386acac15606b884191455f353b022904bb5c497e8e4619d9a08a0099730aee84a03969c5745ecd |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 3c033978f56e62701993b485d3dc2a04 |
| SHA1 | 628d8a48a24c994afe62095873057b38cece72b8 |
| SHA256 | 7aca8ff7194cbd58c5068b2bc8b56342b33e3fb290d4441612730e553eeef7c7 |
| SHA512 | 85d4305a00f2b1fa36ad97a17b498957434a7bc1408680ad1eaa8396d6d75a8605522286021c1653cd8541c05c09656e51043abfddebfa5dc3515f5f4ac5d28a |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | 016b208cea2b23947c591200efd42bfe |
| SHA1 | d5a95963c6343e050fe457e96e43d7cfe05ddd38 |
| SHA256 | a15ab304fe4296399f3561269983f95352eb82d7c94d3b8e0e82b62577b90ca3 |
| SHA512 | 953c3b00ae81946f758c5aa7680494960820169806ca84adcb1df7d94ebd67f501bde571bc695a8b41f061619bf314169bf7f93c706cc371dc311ab30f84d7ab |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 6d32ba462c0f3c365b53e5d8cad914f2 |
| SHA1 | e7fddcca32b207e8c1db127e2b298819b0381724 |
| SHA256 | b8a673c271c08d76543bbeac233d0d10bea3d0ecaffa0a9c17dc1d7feec1cbd5 |
| SHA512 | 7995049cfdcc726bc8f987101fd6628ffde40eb0a7e8e6d1f170b8596a60410dd1ce1e42a5b5dc436dde05eff8a32be6b5855a9599558dfd9246e3b4636329b2 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | a4a6844289cdafc5f26a43aef0239ede |
| SHA1 | a809db88f74e97c8eac98cd111bb778ee8beceb7 |
| SHA256 | b6dd3391c35b0d051567c610d9498bc457f1cb4401b40c383164a048cc9a63c1 |
| SHA512 | f21d78a13a9adda62ea5a59ddb0333f6bd06e4e3b0babb01d92f3e231aeb89a43d6884562ff9e8a9c112e9bb6bec7589804a90b9d5b7e43ffebc23ed374c645d |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 4fa694a914abcf43bdeb25d4b7004c6a |
| SHA1 | 6e8c1d8af2e8fdf4152697cf1f1c16003f9105b2 |
| SHA256 | e145a2dc5e3d9028bae3fd6876ddf782cf595714967cd680da8a1d124bc0d663 |
| SHA512 | bea3d862f0cbfa2056da43cd1494a25dde95f4c49cfad65ed706cd82349d2dc6e9531f988068863ca1257166d34c5e8ea46f4698d9866d2f1e1b273555eacff8 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal
| MD5 | dc93ba53ad1e0f79dfc62b03ead7dfae |
| SHA1 | f7ee650400fe5daf5a4b0a595b7983599da028e2 |
| SHA256 | 89828600ef895a1b9289a9af9a0f7e61d93406892bff4bcaf8390d6565adac49 |
| SHA512 | 74170740289382b53cb61eaf5edc40819d5890f4d0aa509166e50a36e0b356245d92a9402759dcdb1f1984409a344297d318d3a6311670e80a9382f68b9c42af |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 720589f0f2f8201900329edafc42a113 |
| SHA1 | 3dfa3a3e1bc6f006b0488abc3a0143af6abc1c27 |
| SHA256 | 543aea7cbf3be4c12119572af98ea6fda72e8cf886edd19a6ba8a80263e16c59 |
| SHA512 | bc4da98c2bc11dacf7e5b8edf23ba5a123faadb5a02cbdc4f082109619ca956c93b3f2d1a5b44aa039ccb0e0915ecddbfb2bd71307df7fd4fba6d38ee9cb63ea |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/6e4b1c65-76ea-41eb-969d-e332ac96e8ee.jobs
| MD5 | cff9f19ac86915c3a0f11f0b55222e75 |
| SHA1 | 34e369f7e358f31a89a3a1539c670b2755bbd170 |
| SHA256 | 182e8aebd0b84931c80fc6464087d846b9015457f53ba21f3d307de350b6cf04 |
| SHA512 | 2817befbc2d0e5be174900403ff2219ca24f4335c4c9b88f34c4401199aff50cf14e1de33faae45adf28121dc491e59ce9ba6724b690a30e767977fc7a0ede25 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-23 13:57
Reported
2023-12-25 06:15
Platform
android-x64-20231215-en
Max time kernel
2677818s
Max time network
163s
Command Line
Signatures
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
ir.online.afragroup
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 172.217.16.232:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | sdk.cheshmak.me | udp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | nayrica.com | udp |
| US | 67.225.218.22:443 | nayrica.com | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| GB | 216.58.213.4:443 | tcp | |
| GB | 216.58.213.4:443 | tcp | |
| FR | 216.58.204.78:443 | tcp | |
| FR | 216.58.201.98:443 | tcp |
Files
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | a864006b36e5d6a43d24bbba5882bdae |
| SHA1 | 15a88cdb5f8d648f6a86e905fae0d7950aa590ab |
| SHA256 | f22174734250b99f5fac0a9085b9563f4ffdab97a9afe066ec2cdd9253d43fdf |
| SHA512 | 2344c8936070d42156215433cdda45d85da4f78016ed6d434c6d9826999ed2685032799ed1bb96a6d7d24fc53a8667c5c22ee9c12e4888df9aff63a97fba7a40 |
/data/data/ir.online.afragroup/databases/db_default_job_manager
| MD5 | f51ddf19810d101866412e75e5f09740 |
| SHA1 | 0bda9a412a23f240ff399a0ff12a4a9b5395068d |
| SHA256 | 10577c1205da505c40fdeba7bb525c52582cfb4da93fbe6acae17db07bfa673a |
| SHA512 | 2c1648e3c2a7a960e5274fb2b748d0b7ec824c74fb68923925ab190473f3a11399b539fc3320cdbce020193f823a1e0791d5c95a7e063b55f7d8473f1166eeb2 |
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 069489de895a7ff4db809b9d2b3d1af0 |
| SHA1 | 9d4856d17425ca5bb7112f9c834a6e7db08698f6 |
| SHA256 | 36647d7de4ff2846d183cd46986170b2fff7f79271d6fa0eeb5a09f365fc9215 |
| SHA512 | 8871e3779bd2e6013b6dcaab69c4940f4a4ec1af5fac171ce11dfec444ad1a38aa17ae628d25aa9264793e36ec187956685360bfe630f4f10ac548405adab4a3 |
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 03d0b9aad81924d1663d5d04f0cdb5e9 |
| SHA1 | a06c650fb27b52d113654751797ab9a8b9ee0cbd |
| SHA256 | 65b209709e39a9327ca6f7e8e835acfcf0af6fc5f52a22ab69ce44ec5baed6ac |
| SHA512 | e4755060b08406ad15b793024a3772875109dc2e5854d2c4c9d4e745467be57a8a922a9650d3a595d1c08fe30309392ef61da772abc6343e2740dd8819e13f11 |
/data/data/ir.online.afragroup/no_backup/com.google.InstanceId.properties
| MD5 | c171479143f6046f3cb32787a6901ce9 |
| SHA1 | 42eb1cf05bd478ec8959c02a33b9b7f735194f72 |
| SHA256 | 525c357fe993bd4cbb95fc82387419e63865b428c1c45ccc6742271283bf12af |
| SHA512 | 028dc9f6483cc5af26c82f4f173a5d4b25281b46b32e1c9aa5bc644b20bf1a27e8295bea95d51d631887d443c013ec93892859421fe210020d8ee7307cead040 |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/9bf756bf-6d4c-4925-823c-f25520436161.jobs
| MD5 | 90f2c078efc9019bf8e6b2e8aea33015 |
| SHA1 | ee5c35cc2b5766222f7241bef3fe58c71e58b970 |
| SHA256 | 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee |
| SHA512 | 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb |
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 281c13a991658278542374b18bfffc4d |
| SHA1 | 9bdf54ee97891399ded4abe64bd064f2032a47ec |
| SHA256 | 10c788ba0a8014b559b284c0dd50a6703c2e9d917e00da078689a55f19429bf9 |
| SHA512 | 3aedb9a2c67d1a4abc34ea96b8a896bf6f004074a0304927d507c6bcfd62d93d07e005a30b38ad445a463a024dc023afe6bfe21da6de0f78d4024dd47b7000cf |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/357a8d1e-3440-4312-957c-879079b9027f.jobs
| MD5 | 427dd503a5eb5c6dea198ef16aa4f04c |
| SHA1 | c77e0224563605e6473e78123805e5ca1ae77149 |
| SHA256 | b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5 |
| SHA512 | a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670 |
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | b1891af7a28e56e66e4c8a4aad5a707a |
| SHA1 | b865c61f74d1cfdf2614b672d5292b4e78bab4be |
| SHA256 | 8c47ae729668dbe7054903c5201bf41087108d5eb5ca8c03bb693ae5e973aabf |
| SHA512 | abb5fcf738feb49e1575bdd0cdcc702aefc62b791bfcb772d9b6411b6d128d632bf04de48a7b758af6088b4f6b4531fddade43f35442fe3b667faedcb5240b49 |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | ef087412f98e3ffb514a145df17ea670 |
| SHA1 | 7038ae120ba9a6f9e81876623aae048da3dbaf44 |
| SHA256 | d7d2aa7ab077b439099396daaeb8234344cf91a3525bc6ea8e51906e9da7a79c |
| SHA512 | 0674663151551fd4a61c0557545f746f70f80b474a932a680722f4f66a511271c4d481da992814875be444981ad027a45cb09e647403b288a1fb6841700c6143 |
/data/data/ir.online.afragroup/databases/cheshdb
| MD5 | 259a1e4e7ebc4b0d0341ffcf0c3bc2ea |
| SHA1 | 9b8da5a0b24833a3e84567d9d8ee0d2f54d7b48c |
| SHA256 | 4f4987ac3d84abad3490459fa7a32b7bfadaae5f329e15dcff36e07d34faaeb1 |
| SHA512 | dc1296e2b0b18dd83a3782acb700e155ea9a60ef193bfa8c98999e7cc3c5b73a97c20a974cc956ab438aeeba812ec2d2f401fb2e714bb9bb5fb421fa4b7a2313 |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | aa4f962bfaf995cfb77b433322dbc946 |
| SHA1 | 75bea83b03edf60137ded7fbde02bd52ad142317 |
| SHA256 | 69ddacc180aa49271da3940fc0cdfb948bac2b208108a07c29c7d6772cda9cab |
| SHA512 | 00f26280d939c0680ffdccc3ad2ca744601bd22b16d1e8ebc0ae5dee03eb7aa95bfc9c23b236d4146786fe0629e561f4a9780d2554cf41cc198515d831761c3f |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | 03e38c972c9969e43ccce8dc8a79fa79 |
| SHA1 | 5c7299f7f4654bad1100aba48a323b464a145764 |
| SHA256 | 857cb35286f5fcbb166818939a11460dc6301dda597b7c2d073b50b1580998b3 |
| SHA512 | cee763c4f5ad6fbc61390c223b5a8eaf3f698772b1259f86644a9f2d492839fc5451f4c19ffa1ee5e2ee3cb4311fcb1567eef5d6c93b16e7a0ff6a97bf94e490 |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | d0db30937d1ee24e53845460d50c54d4 |
| SHA1 | 8cb4130b4c76f172a777c589f384b1363e9f528d |
| SHA256 | 3f944dfa2c18bb3469cee70f7b704b30e5fcf64f54fa519bad6fca85fb9b4ccf |
| SHA512 | 19c36fa078a9ab38c5b49ee81937c02b076743bff07e04a78baf21176f4dc47551381abc0d9ae33bf3c9a82b4532048b613a507e59147b048c28494c321f495c |
/data/data/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 02054025cba63b08c744273dda680724 |
| SHA1 | becead3f59dd6b6542c54bffc97318369f5ea741 |
| SHA256 | cc4ba462badc59f1b60d3148aa5075aa6ba8fdfe75565ce54448e309b7f2c113 |
| SHA512 | 6a1d28589c179b21a8657bc28fe45f1e43deba1c635a1011638f837a7f38f5da5151fcb4879fdb42f63f015762714a6f43a8cbd64315eab6da1cf4fed2e524b4 |
/data/data/ir.online.afragroup/databases/cheshdb-journal
| MD5 | 7745d9704030a32451bc656d7895403b |
| SHA1 | 5d85631ba78bdd174f1e5f9c42738069681921dc |
| SHA256 | b67f61337296f2ce09946388a366251b8666716eb65e02772efb618eb8711097 |
| SHA512 | a7d6093c7dd601e0ed8bdedf44f44df0a4d19922450cd565c6155a77d4354fabe4fa1937487f71ce7e76de90e059942e989a5ddc41fabaac13a918fe25110d72 |
/data/data/ir.online.afragroup/databases/cheshdb
| MD5 | b4b97dcb340a11d9cc9552d31bb6b31f |
| SHA1 | 3b1c2a88392825b56e6d697114c1a89d9310fd55 |
| SHA256 | 23597570ff132f470c34df5056ad8bed253183b80cd2fb34abbc4d2d1e5d65e3 |
| SHA512 | 8944a7382f130914d5609c1b3e1cd7261117eff407c4c15007b0e69309fc6565c43ee7a73b934e9dc94f4bb9fb07de0a644fb78e03fe80fac3a6e8799fafe7ec |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | 1f9eee45a2eb3e39938d03999b88a081 |
| SHA1 | d5c0781b856b7c16c4676060a2eb71b8c944caae |
| SHA256 | 689d5123762eefa06f8cec545cb1a0bffb3f48aa75c446661ab766bcd2b41dbe |
| SHA512 | d820d98d283be7fbc4e9c301b591056fb62642e738f55e33792f6901568e12d896668832f0eb46e7320c260ed9eae749a92fa44fbd32dfc0097ca523f45b3f78 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | eb52a90bb70b76e946b62f50b6f7fb85 |
| SHA1 | 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0 |
| SHA256 | 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4 |
| SHA512 | b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | 670f5079ebe5d2e71fffee760aceac11 |
| SHA1 | ab0a2121f94d0698ecfb5e006aecd735c5115fa0 |
| SHA256 | c68906576e66c02fbe8a5a85471ae370100d43c63568b4b7084ab560f1675837 |
| SHA512 | 9214efb9236120f43e130d87707a5ab8870b2ae8d0e68db8437be2a1b1881be14623f090de005325dd7d9ca3dec949ef534c3b145a5bcfda60f4ef21c7251529 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | d3210b0392097a62a64fcbbea61e8ed9 |
| SHA1 | 0a74ed7bc4eccb3944d79cf3e5c21bd1e9802162 |
| SHA256 | 6ec2cfe84f88200f649c00be6813726b89d5a679e6a58ddc9c77b5357eb22352 |
| SHA512 | 7f7747a463cb4dc83341f2642c2636bc73e1077d56fc10eeb4929f9448dfbc788c3e0386069b899c34310bf35ed050ec269b58f36c73864f37c89a55f00df173 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | ce5261c61624edf89aea12f1ed44fc9f |
| SHA1 | bea65d0852b34cb7b17fbb55729139897029d0e7 |
| SHA256 | 05919304dfbcc97ba2448c2ab1b42e8e0899545c2d0121ba8054c68d60bb32d7 |
| SHA512 | 698983f87aacbc090c99b2c9f841d265aade25110736445cc4d99f68e468002a2d790ce3bc950478bb36b74d2a907a4f41e9bc0b325e746c3869335186c1361c |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | 131272d1633219b0b088e16a96d8590b |
| SHA1 | 9e78920902f1cb435f8279d3d8e7c2e910551aa5 |
| SHA256 | 4cb1b6c71362d913c30cdb1571d64b66970120039d6b79b5c9d9ad286090c68a |
| SHA512 | 0b1117ad13ffa7dcd0909862905aa327810471dbdb0a0034f9bf2cb0eca6bfb92dffdbd329f11d8ba62a6db519edf62184088a1c029c40cb9a7f024263718ab4 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | 93df9b68cb45f21269b42a84b54292d8 |
| SHA1 | 21af2c06bed8c47be145070b02a066c8fa4bb218 |
| SHA256 | 66d6e0a5fbdb81bfd7b6f5d6a91ab2ea92f8e3889ff972114683909130f33e9d |
| SHA512 | d3073316b9ec7d13d460c807d2ff03bdfba2ebd47b199f7946b489fd9f4f7dcf7c4fb94b8e0d3220a61fcd77312c3dd45cffb3121ecc3aa29400696c74082fbe |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 06f0c3556e04460e427b5e26c93b80d4 |
| SHA1 | aa89f64990dd0f091e633d8374a6a03d557683bd |
| SHA256 | 0505f95c3e16ed924fcbdc067f32a54284e2ee13beb197ce813013d4625e218c |
| SHA512 | 2310cd6524b394cb63898bb0884cbc63a6e7e6b6e028198aa6c304874660a35e9308ce40b1869671575787436995bb91e8b9cbf1d2bcdbc075c8f05182d91e7e |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 93659a10d5a0d6036f2a2d828d1540d8 |
| SHA1 | 899f311bcfa1de6c084b2483e9242304c8ab593f |
| SHA256 | 7c6e79831b43b42defa44530a08e3c2b2c5296cf24c3f39724d4a9210716df0f |
| SHA512 | 9eb1910859192cadaad8bad65c433a561477c13e215e2a851d3df79c04ffa89db41d80a04686e2e475819a21bb132bdb499c518fa63f6200c361cdeace2346c9 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 4e381a8eb20d7200ce35f79f876dd998 |
| SHA1 | 3f13783b4ec119e39fd71d91362f75a1c5768f2a |
| SHA256 | ee11be0a258cebdb57bb92fb843c3d8e9165d39e6b23cbd2f69c433a819a9280 |
| SHA512 | 96ffaa119171c494244fc371b5750b3901e95c75c6e0272cbd0782e1dd356d461831a52649f6c8dda23b57dc3197099b725dd96ccf46093593a4d55e1fc6550f |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | fa9860048ee0f1d5ceed282e8bbc1b2b |
| SHA1 | 52e3f76f11d0bd342c8ae7472c97a7991a20d8a8 |
| SHA256 | f48cf6535c0e5b159d49148cc886b790eb7f8b845195b89c72076f40ba495e27 |
| SHA512 | 795467a298fc4f8c78b66977efcef5b65bd1d89d1967854c6abb12c329553fa729a681d88fc64d7a131a07044cb40ea15e17fb184f27920b29876e83c265d389 |
/data/data/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 16d25bafaad6d158417c16a475df3342 |
| SHA1 | 19f5f3ca61d8e6187df7e380d2101d29617b6096 |
| SHA256 | fdf55fb5d0d0c487f44f35136c21584ba466445659653dccbf647d68b789d051 |
| SHA512 | f197c7ab1d5fbe0baa123a69dc07daa3b1f5e083993745fa190547601ef4109853f6476efc9ce00cb6d5ee60f1a204157be5081cd312b93caef3dc97574fbadd |
/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/a0681934-911f-475e-8a16-fe20e6c96a3e.jobs
| MD5 | 5368438bee84aa0087eb3402bd4fbd52 |
| SHA1 | 508107b1beda708e87c280282e8ae79d4792f050 |
| SHA256 | 5db44f7d7a7aa86410c61d27606093df80191cd44e19af58109b3e0bd62b4fae |
| SHA512 | cf5115edff37896699b921cbdbc85ca6000312f5ca32785cb22e9d84f171488447d256941740b115b704ba3c9de7123f2dfe7f8df1e7a963d8afce5e5a57bfe1 |
Analysis: behavioral3
Detonation Overview
Submitted
2023-12-23 13:57
Reported
2023-12-25 06:15
Platform
android-x64-arm64-20231215-en
Max time kernel
2677824s
Max time network
131s
Command Line
Signatures
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
ir.online.afragroup
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.200.10:443 | udp | |
| GB | 142.250.200.46:443 | udp | |
| GB | 142.250.179.238:443 | tcp | |
| GB | 142.250.179.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.14:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.232:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | sdk.cheshmak.me | udp |
| US | 1.1.1.1:53 | nayrica.com | udp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 67.225.218.22:443 | nayrica.com | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
| GB | 142.250.200.4:443 | tcp | |
| GB | 142.250.200.4:443 | tcp | |
| GB | 142.250.200.4:443 | tcp | |
| US | 199.59.243.225:443 | sdk.cheshmak.me | tcp |
Files
/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | e0267c762b801ac41fe7ddfb6ebb44a8 |
| SHA1 | b6b1bf03764f221936ff2a6ad03b4594ad2813ed |
| SHA256 | 83b468d41e1d578f907a32858204456f7e3de0fd4f249615a7ea344eaba12182 |
| SHA512 | 298e98a699f5deeb2e391478c3a7fdeaed4b36bb5a640be0d84c729b3660be4d0b447555e8a2cdcd7cebde3237b097ebc3c85a3918aa968516707a5884d2d583 |
/data/user/0/ir.online.afragroup/databases/db_default_job_manager
| MD5 | 437c8101498d4457b964154449abfb7b |
| SHA1 | b5890fa98d457b6bad93a7b6f33c7dbdb7500311 |
| SHA256 | 9ace808f401c0fc884db282a4cd2e0bc9bc6e13e8314d111ff54311b329f2879 |
| SHA512 | dad6fc3a1ea56f175854f69a5901c7b52c4f0184859697ae65b784df0fdbb882ae079fd745f43935c051b4bb472da9c3afde291569b137ffce0163dcc7273606 |
/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 2f6c12b7107e27d64852b10f46deaa05 |
| SHA1 | a4b467d093f6bfc0593bf392de5078df107d5333 |
| SHA256 | 4574ae11341da346e4ad50386426efd1dbea52264ba57923635ccecbc6c8a4f6 |
| SHA512 | cd16be0032b6387edcb32f5db0799de7a489a87b20f2b41d58675d717e8268bc21c39ea0ce07726cebe100b083f2fa99d2ea9b5965b6ba02b67e9394056bdd91 |
/data/user/0/ir.online.afragroup/no_backup/com.google.InstanceId.properties
| MD5 | 0d4667e96b3a537a4bce4e8faa7984f2 |
| SHA1 | 5e8e709dab8eabd70d7bf50adfdf20045e9fb8eb |
| SHA256 | 44cd8b8c8bd24330edb13cb04e3d006f95ee9a97be2fe9c79af5c0fce9acd22f |
| SHA512 | 2496d8e91382227e4fc7ed251f4fe154df34af8fc42790bd4974002961f4317a903a5b5d1ee11e24e2ae22ceed2e3be468be72862e245e3f68a625f2dd754651 |
/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | fe81d5f4965b4620bac859af17952414 |
| SHA1 | 339ab0893740245295799601d52f10313d7c96ca |
| SHA256 | 5804c301e1046629b7efa4e85242396daf3f9232c8db9cc2de0bc8d554b3be52 |
| SHA512 | ea64a9680bea4f983f867fe330908b201d015ac27b75d31fff405806049dc83bf4439870ad9f09b3f15743391b84870294a5ce1899459095c36dc38b17e94739 |
/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/13744a07-55f4-473e-accd-20a4dda7a99b.jobs
| MD5 | 90f2c078efc9019bf8e6b2e8aea33015 |
| SHA1 | ee5c35cc2b5766222f7241bef3fe58c71e58b970 |
| SHA256 | 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee |
| SHA512 | 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb |
/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | 3351bd00ec06d2ead98970f7c86bf139 |
| SHA1 | 8c89c90043457844c33286ac0ab275d7cb9ac2f6 |
| SHA256 | 9c66ac7e5d64019b9036eebc93386c1267ca5aa1a40c8ee36fc347e111c6fe6f |
| SHA512 | 485b4f3f43a75d4222f9b6ab4cb1bb0a5b9ea42c7acfb850e88b6d9fc06975186cba4c11a072908955516a370be5aba89456aed0cb694ba8e202459ef698d27b |
/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/fe5a9e35-a8b4-4c1f-95c8-09cda4db0ee4.jobs
| MD5 | 427dd503a5eb5c6dea198ef16aa4f04c |
| SHA1 | c77e0224563605e6473e78123805e5ca1ae77149 |
| SHA256 | b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5 |
| SHA512 | a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670 |
/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal
| MD5 | c9306a444aabbf643f65cb67e5ab4698 |
| SHA1 | 51058466068ddd27b1198a142f91180db79b337d |
| SHA256 | fd26188c04543aaac12aaddbf5b8fde3f8e611f691de55a05ac3bc782e416a81 |
| SHA512 | 1ea03c3b6c60365851328afeab74dcbad1a8487531135f256cdf7ce42805eec5b312c3ab812e06d958cf913a01adb2512b9316516cbc96ae6b325a09859dc849 |
/data/user/0/ir.online.afragroup/databases/cheshdb-journal
| MD5 | 7b333247fce4cbe5bcc3db7ee2a0e536 |
| SHA1 | 47a33c827f2055f46b635e776370e0f1dcc2482c |
| SHA256 | f09f73a2c178534a21b194f2d15c53ef6b08a790127f1257bacac72bc429a4ab |
| SHA512 | 19dff7f0d8d03b06552e54d6cc9e2c45a5363932c8c135cc197f2e0a48a7f20dd6f85ad2a799c8fa645ad81cc7343d979c0c4ca9837c9d1b42c4fc763deb698d |
/data/user/0/ir.online.afragroup/databases/cheshdb
| MD5 | f41f531c07d4141546a531ff9caffdcd |
| SHA1 | 9dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5 |
| SHA256 | bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646 |
| SHA512 | e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4 |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db-journal
| MD5 | df5b7c06802a28ffdc76fdfea83059ae |
| SHA1 | 8d13762395e857d71f1cf6ba4364abd47a008c9e |
| SHA256 | 27088643d9c3c8b8eb29b88f04f68ec3f5df236bce5a3df292a40913c2fbb310 |
| SHA512 | c0946b4af87ea243c961f5a676451983f8a836e6cc85d0e237ec4ebe3c7dd5f0d65639c3c1a6ec6f3d643515a816527bd32e4415af2a4a35285ceca86ca3349c |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | f1a190472ce7f42880211697876b4e35 |
| SHA1 | 71bf89185aa80fbf8eae473058c146b3c2a7f32e |
| SHA256 | b07362724a2374124dab26fd39c488460f18912b399a4e40de022085aae1c6bf |
| SHA512 | 93381130af3c39f118563e49b91110bd71c0936c99a4c84afc49f13261e3c1b2f24925f076b7f107444fedee5eb02703d10db52fa21f76027ea4d7f78969f5bf |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 1ac62172f61570cc6407117fb9c36f5d |
| SHA1 | 285cea0205e15538243ad80c37b19046c0d8d4be |
| SHA256 | bfd92fe4a62183f2eafabea9359f394508eca7621efbe67a2ddf2556881c70d8 |
| SHA512 | a9fa87de6c6e646612201310365b9d7b2cbb0d02a90dcd6fb5f56b7674c8a0affca2eeb2b45cccbdafeac23cea022d8cc2ec3e92f2471d1d5f4c2b6fa9b722c4 |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 744f972b406ef51bf92fe313fcff7779 |
| SHA1 | 596dc5d7bed947fe257b3fe1fe3c5e9dd44830dd |
| SHA256 | d9d6210273d3a2fd6f2dcd2baac86181502bd4941efcd07da3ecd82d43dcd95b |
| SHA512 | d4300693bf2ff8ae6f9277399cd7ad48f2f43ee381200073ac548eabb01cf0b2d42710e182204dd194d017656116b88cefcaa96a2eb3c11bd8fbd7e1d1b96fdb |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 6fb71cb73e37eec316a3107d34cc857d |
| SHA1 | 4ed90100abc4cb0746e301752a9ac9410f6a803e |
| SHA256 | 31e1c2ccb53caff11853af8c22fda8d67b62e621082b9665d835e1abf9bebf58 |
| SHA512 | f8089291d2251e500ab8e932e642f1de19b33cf790c3522d8a5a48284406cea9af252a59dd64575ecab55e2bdf039466e457e5f6bc503579431276cb1127c123 |
/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db
| MD5 | 8d0cd16581ff038bbc5e88cff4e8ad97 |
| SHA1 | af55a06a1a75e0c5505b71c89a4959095fca7b51 |
| SHA256 | bc034e9e3e9900bd23acd68a09598e0f4fc6b44bbf09c889e1f21ee4a6094e89 |
| SHA512 | d3aabd95a96fb1a86bb7623b90df3cd435f2897f59926296d8df1a13616b7f1570562648777a3706cd62681367727247e006f9dc503868d660e87ab7e6ea612e |
/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/12965bae-239c-49ca-b050-26e2144c4919.jobs
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |