Malware Analysis Report

2025-01-19 06:40

Sample ID 231223-q9c38acfcp
Target 27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
SHA256 27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17

Threat Level: Known bad

The file 27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17 was found to be: Known bad.

Malicious Activity Summary

irata

Irata family

Irata payload

Acquires the wake lock

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-23 13:57

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-23 13:57

Reported

2023-12-26 23:51

Platform

android-x86-arm-20231215-en

Max time kernel

2827636s

Max time network

128s

Command Line

ir.online.afragroup

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.online.afragroup

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 sdk.cheshmak.me udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 nayrica.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 67.225.218.22:443 nayrica.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp

Files

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 a484f1acfa59ac2d8e207806168cb552
SHA1 83f36d45fa77dd7068475539ae325fb1b223b20b
SHA256 003bba0f3c6dc9c3552b8030c0fdc4eef2227caac99e92a66821cd875c8df981
SHA512 c4ca51a0ce96c09cde1e8473757b7cf0b758e94e0b48c38154ea6bdd337bae32ee2eec0eb0293a16fe649d160345ee8a8e2af8ce4188aee30950d1a5a29a34c2

/data/data/ir.online.afragroup/databases/db_default_job_manager

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/ir.online.afragroup/databases/db_default_job_manager-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/ir.online.afragroup/databases/db_default_job_manager-wal

MD5 ae1be1a65fdbaea9ba22b1e6a5325b60
SHA1 0c20ad2ecb3e7bacbc2dfd302832a0e970b93b7c
SHA256 2605c74cc429977e9726cc1a95f8517a7fe7544841c9701ab622b1c605c7dba3
SHA512 5dc297ebff1f7b833ec5f8fdccffbab63518ccf31f35f7e19c80b64048ea600c17344cb95cb9d4eda869d112acd7ccc22a359f7a76434f23b4832d6e7ab13837

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/fc35aa2f-7037-4a88-b677-828fbd51c51f.jobs

MD5 90f2c078efc9019bf8e6b2e8aea33015
SHA1 ee5c35cc2b5766222f7241bef3fe58c71e58b970
SHA256 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee
SHA512 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/042b6b9e-3367-41fe-ac5c-2944f5166708.jobs

MD5 427dd503a5eb5c6dea198ef16aa4f04c
SHA1 c77e0224563605e6473e78123805e5ca1ae77149
SHA256 b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5
SHA512 a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 8111622d11538afe860c367c90209b7a
SHA1 7522f65f064a7683f1177f2e65f06ad84d44152e
SHA256 f98c32e78d19846fda70863d5e60599e7a0618640c0b500c01b89b48321a6e10
SHA512 3138267eb18e09744b59d5584fadb81c663d91c691ca4e6d8bb0f04281708afbba3c0cce96586fac57ba3ad25c556ffa644596d71ccdd843f48738a9d8acb49f

/data/data/ir.online.afragroup/databases/cheshdb-wal

MD5 890c39cc661ca0a0473eda113a79bd30
SHA1 f50fa4eb022fb99a337880bdd64a5e482e6a2f1e
SHA256 96f9766e242ed948d1d82b5ef5c296ab1a19c650f26c85747fc5fcc2baf1956f
SHA512 9847a57f830bb811a4dc22a48078ee7eb51f5ad4318237f746f121bb7fcd4d9642c23ddaf1b6823157860cfdc58dfe221c8bd1119bef99c6b0b6b8b7f385c44b

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 1a06128665daa510965dde818e86b7e2
SHA1 df34d8821785d0bda9417b8100e09cd5245a3b47
SHA256 81715e4f925ba9bcb00aa72dd74a3a3d6e939c8bd2b1aebd9cc594b965b0a5d9
SHA512 62a0c8f36e9859b656eda1d9a42f26ade18e0e9c5740a4201757c5df606851aa622d4f2006e2dbecc2f5a70717d8aaf9b732f0a0a95c2f3f016e7bc46211aeb1

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 1a6478a4833b1423d8d5e203dcb48e4f
SHA1 4836e47746c712e786d939415d7b160db18973a2
SHA256 129eea44a66676e704014a9ef6c6c751d7c857f08d9feb294db8e3f06ac59937
SHA512 d2825267e28235f8494622e0482cf0776ff6dde9f40bb9d04a8002fd0d489f5ab3c733b097c18958453729dd31f0953d7927ffa237380732a582702d00dd88a3

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 839c24a6d746e6a98b56736bede144da
SHA1 793cc7075583537d5f23f9b01342a4d415321aef
SHA256 a2d4d67a3903768fc958650ac69d265b088795cf809ddcf77758378adc107d5e
SHA512 ccf5cba31bf57283d3c9db9341c368b22e8041a7297ac72f0514095663c25b5a8395d6f234b581d66be36fdec6155340d5dd686527672326ae343fd51abe49a9

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 dd0e7ef76d6fb3583b328e09af086835
SHA1 d34031e80a75cae125dae7438e100dd4c2cbb7bf
SHA256 57b5f38a846de39d642750c9345bf013579ac5b3f74ce719efbd7846a7bac6d9
SHA512 cbad0e66dcb0d2bae38ffcb6477bbd9014751a8bb113dad4656a1241d5d52f71bbe7b7c5df16afdf97275c609e8dec888feb09d00bcb9eb54e13db18b7cb0260

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 d57b0d74bc4a840933d027d029d78986
SHA1 5e4939a7a144e586d306780837de81ffd6cd4942
SHA256 d1c3c86876b022b2ce00bf85e302193a893719fcc27ef2a151f9b812cbd9c2ee
SHA512 b9d4ff860a69d24fa76f30328f8040c7447bd181b86e88f81386acac15606b884191455f353b022904bb5c497e8e4619d9a08a0099730aee84a03969c5745ecd

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 3c033978f56e62701993b485d3dc2a04
SHA1 628d8a48a24c994afe62095873057b38cece72b8
SHA256 7aca8ff7194cbd58c5068b2bc8b56342b33e3fb290d4441612730e553eeef7c7
SHA512 85d4305a00f2b1fa36ad97a17b498957434a7bc1408680ad1eaa8396d6d75a8605522286021c1653cd8541c05c09656e51043abfddebfa5dc3515f5f4ac5d28a

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 016b208cea2b23947c591200efd42bfe
SHA1 d5a95963c6343e050fe457e96e43d7cfe05ddd38
SHA256 a15ab304fe4296399f3561269983f95352eb82d7c94d3b8e0e82b62577b90ca3
SHA512 953c3b00ae81946f758c5aa7680494960820169806ca84adcb1df7d94ebd67f501bde571bc695a8b41f061619bf314169bf7f93c706cc371dc311ab30f84d7ab

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 6d32ba462c0f3c365b53e5d8cad914f2
SHA1 e7fddcca32b207e8c1db127e2b298819b0381724
SHA256 b8a673c271c08d76543bbeac233d0d10bea3d0ecaffa0a9c17dc1d7feec1cbd5
SHA512 7995049cfdcc726bc8f987101fd6628ffde40eb0a7e8e6d1f170b8596a60410dd1ce1e42a5b5dc436dde05eff8a32be6b5855a9599558dfd9246e3b4636329b2

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 a4a6844289cdafc5f26a43aef0239ede
SHA1 a809db88f74e97c8eac98cd111bb778ee8beceb7
SHA256 b6dd3391c35b0d051567c610d9498bc457f1cb4401b40c383164a048cc9a63c1
SHA512 f21d78a13a9adda62ea5a59ddb0333f6bd06e4e3b0babb01d92f3e231aeb89a43d6884562ff9e8a9c112e9bb6bec7589804a90b9d5b7e43ffebc23ed374c645d

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 4fa694a914abcf43bdeb25d4b7004c6a
SHA1 6e8c1d8af2e8fdf4152697cf1f1c16003f9105b2
SHA256 e145a2dc5e3d9028bae3fd6876ddf782cf595714967cd680da8a1d124bc0d663
SHA512 bea3d862f0cbfa2056da43cd1494a25dde95f4c49cfad65ed706cd82349d2dc6e9531f988068863ca1257166d34c5e8ea46f4698d9866d2f1e1b273555eacff8

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-wal

MD5 dc93ba53ad1e0f79dfc62b03ead7dfae
SHA1 f7ee650400fe5daf5a4b0a595b7983599da028e2
SHA256 89828600ef895a1b9289a9af9a0f7e61d93406892bff4bcaf8390d6565adac49
SHA512 74170740289382b53cb61eaf5edc40819d5890f4d0aa509166e50a36e0b356245d92a9402759dcdb1f1984409a344297d318d3a6311670e80a9382f68b9c42af

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 720589f0f2f8201900329edafc42a113
SHA1 3dfa3a3e1bc6f006b0488abc3a0143af6abc1c27
SHA256 543aea7cbf3be4c12119572af98ea6fda72e8cf886edd19a6ba8a80263e16c59
SHA512 bc4da98c2bc11dacf7e5b8edf23ba5a123faadb5a02cbdc4f082109619ca956c93b3f2d1a5b44aa039ccb0e0915ecddbfb2bd71307df7fd4fba6d38ee9cb63ea

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/6e4b1c65-76ea-41eb-969d-e332ac96e8ee.jobs

MD5 cff9f19ac86915c3a0f11f0b55222e75
SHA1 34e369f7e358f31a89a3a1539c670b2755bbd170
SHA256 182e8aebd0b84931c80fc6464087d846b9015457f53ba21f3d307de350b6cf04
SHA512 2817befbc2d0e5be174900403ff2219ca24f4335c4c9b88f34c4401199aff50cf14e1de33faae45adf28121dc491e59ce9ba6724b690a30e767977fc7a0ede25

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-23 13:57

Reported

2023-12-25 06:15

Platform

android-x64-20231215-en

Max time kernel

2677818s

Max time network

163s

Command Line

ir.online.afragroup

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.online.afragroup

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 nayrica.com udp
US 67.225.218.22:443 nayrica.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 216.58.213.4:443 tcp
GB 216.58.213.4:443 tcp
FR 216.58.204.78:443 tcp
FR 216.58.201.98:443 tcp

Files

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 a864006b36e5d6a43d24bbba5882bdae
SHA1 15a88cdb5f8d648f6a86e905fae0d7950aa590ab
SHA256 f22174734250b99f5fac0a9085b9563f4ffdab97a9afe066ec2cdd9253d43fdf
SHA512 2344c8936070d42156215433cdda45d85da4f78016ed6d434c6d9826999ed2685032799ed1bb96a6d7d24fc53a8667c5c22ee9c12e4888df9aff63a97fba7a40

/data/data/ir.online.afragroup/databases/db_default_job_manager

MD5 f51ddf19810d101866412e75e5f09740
SHA1 0bda9a412a23f240ff399a0ff12a4a9b5395068d
SHA256 10577c1205da505c40fdeba7bb525c52582cfb4da93fbe6acae17db07bfa673a
SHA512 2c1648e3c2a7a960e5274fb2b748d0b7ec824c74fb68923925ab190473f3a11399b539fc3320cdbce020193f823a1e0791d5c95a7e063b55f7d8473f1166eeb2

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 069489de895a7ff4db809b9d2b3d1af0
SHA1 9d4856d17425ca5bb7112f9c834a6e7db08698f6
SHA256 36647d7de4ff2846d183cd46986170b2fff7f79271d6fa0eeb5a09f365fc9215
SHA512 8871e3779bd2e6013b6dcaab69c4940f4a4ec1af5fac171ce11dfec444ad1a38aa17ae628d25aa9264793e36ec187956685360bfe630f4f10ac548405adab4a3

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 03d0b9aad81924d1663d5d04f0cdb5e9
SHA1 a06c650fb27b52d113654751797ab9a8b9ee0cbd
SHA256 65b209709e39a9327ca6f7e8e835acfcf0af6fc5f52a22ab69ce44ec5baed6ac
SHA512 e4755060b08406ad15b793024a3772875109dc2e5854d2c4c9d4e745467be57a8a922a9650d3a595d1c08fe30309392ef61da772abc6343e2740dd8819e13f11

/data/data/ir.online.afragroup/no_backup/com.google.InstanceId.properties

MD5 c171479143f6046f3cb32787a6901ce9
SHA1 42eb1cf05bd478ec8959c02a33b9b7f735194f72
SHA256 525c357fe993bd4cbb95fc82387419e63865b428c1c45ccc6742271283bf12af
SHA512 028dc9f6483cc5af26c82f4f173a5d4b25281b46b32e1c9aa5bc644b20bf1a27e8295bea95d51d631887d443c013ec93892859421fe210020d8ee7307cead040

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/9bf756bf-6d4c-4925-823c-f25520436161.jobs

MD5 90f2c078efc9019bf8e6b2e8aea33015
SHA1 ee5c35cc2b5766222f7241bef3fe58c71e58b970
SHA256 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee
SHA512 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 281c13a991658278542374b18bfffc4d
SHA1 9bdf54ee97891399ded4abe64bd064f2032a47ec
SHA256 10c788ba0a8014b559b284c0dd50a6703c2e9d917e00da078689a55f19429bf9
SHA512 3aedb9a2c67d1a4abc34ea96b8a896bf6f004074a0304927d507c6bcfd62d93d07e005a30b38ad445a463a024dc023afe6bfe21da6de0f78d4024dd47b7000cf

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/357a8d1e-3440-4312-957c-879079b9027f.jobs

MD5 427dd503a5eb5c6dea198ef16aa4f04c
SHA1 c77e0224563605e6473e78123805e5ca1ae77149
SHA256 b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5
SHA512 a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 b1891af7a28e56e66e4c8a4aad5a707a
SHA1 b865c61f74d1cfdf2614b672d5292b4e78bab4be
SHA256 8c47ae729668dbe7054903c5201bf41087108d5eb5ca8c03bb693ae5e973aabf
SHA512 abb5fcf738feb49e1575bdd0cdcc702aefc62b791bfcb772d9b6411b6d128d632bf04de48a7b758af6088b4f6b4531fddade43f35442fe3b667faedcb5240b49

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 ef087412f98e3ffb514a145df17ea670
SHA1 7038ae120ba9a6f9e81876623aae048da3dbaf44
SHA256 d7d2aa7ab077b439099396daaeb8234344cf91a3525bc6ea8e51906e9da7a79c
SHA512 0674663151551fd4a61c0557545f746f70f80b474a932a680722f4f66a511271c4d481da992814875be444981ad027a45cb09e647403b288a1fb6841700c6143

/data/data/ir.online.afragroup/databases/cheshdb

MD5 259a1e4e7ebc4b0d0341ffcf0c3bc2ea
SHA1 9b8da5a0b24833a3e84567d9d8ee0d2f54d7b48c
SHA256 4f4987ac3d84abad3490459fa7a32b7bfadaae5f329e15dcff36e07d34faaeb1
SHA512 dc1296e2b0b18dd83a3782acb700e155ea9a60ef193bfa8c98999e7cc3c5b73a97c20a974cc956ab438aeeba812ec2d2f401fb2e714bb9bb5fb421fa4b7a2313

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 aa4f962bfaf995cfb77b433322dbc946
SHA1 75bea83b03edf60137ded7fbde02bd52ad142317
SHA256 69ddacc180aa49271da3940fc0cdfb948bac2b208108a07c29c7d6772cda9cab
SHA512 00f26280d939c0680ffdccc3ad2ca744601bd22b16d1e8ebc0ae5dee03eb7aa95bfc9c23b236d4146786fe0629e561f4a9780d2554cf41cc198515d831761c3f

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 03e38c972c9969e43ccce8dc8a79fa79
SHA1 5c7299f7f4654bad1100aba48a323b464a145764
SHA256 857cb35286f5fcbb166818939a11460dc6301dda597b7c2d073b50b1580998b3
SHA512 cee763c4f5ad6fbc61390c223b5a8eaf3f698772b1259f86644a9f2d492839fc5451f4c19ffa1ee5e2ee3cb4311fcb1567eef5d6c93b16e7a0ff6a97bf94e490

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 d0db30937d1ee24e53845460d50c54d4
SHA1 8cb4130b4c76f172a777c589f384b1363e9f528d
SHA256 3f944dfa2c18bb3469cee70f7b704b30e5fcf64f54fa519bad6fca85fb9b4ccf
SHA512 19c36fa078a9ab38c5b49ee81937c02b076743bff07e04a78baf21176f4dc47551381abc0d9ae33bf3c9a82b4532048b613a507e59147b048c28494c321f495c

/data/data/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 02054025cba63b08c744273dda680724
SHA1 becead3f59dd6b6542c54bffc97318369f5ea741
SHA256 cc4ba462badc59f1b60d3148aa5075aa6ba8fdfe75565ce54448e309b7f2c113
SHA512 6a1d28589c179b21a8657bc28fe45f1e43deba1c635a1011638f837a7f38f5da5151fcb4879fdb42f63f015762714a6f43a8cbd64315eab6da1cf4fed2e524b4

/data/data/ir.online.afragroup/databases/cheshdb-journal

MD5 7745d9704030a32451bc656d7895403b
SHA1 5d85631ba78bdd174f1e5f9c42738069681921dc
SHA256 b67f61337296f2ce09946388a366251b8666716eb65e02772efb618eb8711097
SHA512 a7d6093c7dd601e0ed8bdedf44f44df0a4d19922450cd565c6155a77d4354fabe4fa1937487f71ce7e76de90e059942e989a5ddc41fabaac13a918fe25110d72

/data/data/ir.online.afragroup/databases/cheshdb

MD5 b4b97dcb340a11d9cc9552d31bb6b31f
SHA1 3b1c2a88392825b56e6d697114c1a89d9310fd55
SHA256 23597570ff132f470c34df5056ad8bed253183b80cd2fb34abbc4d2d1e5d65e3
SHA512 8944a7382f130914d5609c1b3e1cd7261117eff407c4c15007b0e69309fc6565c43ee7a73b934e9dc94f4bb9fb07de0a644fb78e03fe80fac3a6e8799fafe7ec

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 1f9eee45a2eb3e39938d03999b88a081
SHA1 d5c0781b856b7c16c4676060a2eb71b8c944caae
SHA256 689d5123762eefa06f8cec545cb1a0bffb3f48aa75c446661ab766bcd2b41dbe
SHA512 d820d98d283be7fbc4e9c301b591056fb62642e738f55e33792f6901568e12d896668832f0eb46e7320c260ed9eae749a92fa44fbd32dfc0097ca523f45b3f78

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 670f5079ebe5d2e71fffee760aceac11
SHA1 ab0a2121f94d0698ecfb5e006aecd735c5115fa0
SHA256 c68906576e66c02fbe8a5a85471ae370100d43c63568b4b7084ab560f1675837
SHA512 9214efb9236120f43e130d87707a5ab8870b2ae8d0e68db8437be2a1b1881be14623f090de005325dd7d9ca3dec949ef534c3b145a5bcfda60f4ef21c7251529

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 d3210b0392097a62a64fcbbea61e8ed9
SHA1 0a74ed7bc4eccb3944d79cf3e5c21bd1e9802162
SHA256 6ec2cfe84f88200f649c00be6813726b89d5a679e6a58ddc9c77b5357eb22352
SHA512 7f7747a463cb4dc83341f2642c2636bc73e1077d56fc10eeb4929f9448dfbc788c3e0386069b899c34310bf35ed050ec269b58f36c73864f37c89a55f00df173

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 ce5261c61624edf89aea12f1ed44fc9f
SHA1 bea65d0852b34cb7b17fbb55729139897029d0e7
SHA256 05919304dfbcc97ba2448c2ab1b42e8e0899545c2d0121ba8054c68d60bb32d7
SHA512 698983f87aacbc090c99b2c9f841d265aade25110736445cc4d99f68e468002a2d790ce3bc950478bb36b74d2a907a4f41e9bc0b325e746c3869335186c1361c

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 131272d1633219b0b088e16a96d8590b
SHA1 9e78920902f1cb435f8279d3d8e7c2e910551aa5
SHA256 4cb1b6c71362d913c30cdb1571d64b66970120039d6b79b5c9d9ad286090c68a
SHA512 0b1117ad13ffa7dcd0909862905aa327810471dbdb0a0034f9bf2cb0eca6bfb92dffdbd329f11d8ba62a6db519edf62184088a1c029c40cb9a7f024263718ab4

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 93df9b68cb45f21269b42a84b54292d8
SHA1 21af2c06bed8c47be145070b02a066c8fa4bb218
SHA256 66d6e0a5fbdb81bfd7b6f5d6a91ab2ea92f8e3889ff972114683909130f33e9d
SHA512 d3073316b9ec7d13d460c807d2ff03bdfba2ebd47b199f7946b489fd9f4f7dcf7c4fb94b8e0d3220a61fcd77312c3dd45cffb3121ecc3aa29400696c74082fbe

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 06f0c3556e04460e427b5e26c93b80d4
SHA1 aa89f64990dd0f091e633d8374a6a03d557683bd
SHA256 0505f95c3e16ed924fcbdc067f32a54284e2ee13beb197ce813013d4625e218c
SHA512 2310cd6524b394cb63898bb0884cbc63a6e7e6b6e028198aa6c304874660a35e9308ce40b1869671575787436995bb91e8b9cbf1d2bcdbc075c8f05182d91e7e

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 93659a10d5a0d6036f2a2d828d1540d8
SHA1 899f311bcfa1de6c084b2483e9242304c8ab593f
SHA256 7c6e79831b43b42defa44530a08e3c2b2c5296cf24c3f39724d4a9210716df0f
SHA512 9eb1910859192cadaad8bad65c433a561477c13e215e2a851d3df79c04ffa89db41d80a04686e2e475819a21bb132bdb499c518fa63f6200c361cdeace2346c9

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 4e381a8eb20d7200ce35f79f876dd998
SHA1 3f13783b4ec119e39fd71d91362f75a1c5768f2a
SHA256 ee11be0a258cebdb57bb92fb843c3d8e9165d39e6b23cbd2f69c433a819a9280
SHA512 96ffaa119171c494244fc371b5750b3901e95c75c6e0272cbd0782e1dd356d461831a52649f6c8dda23b57dc3197099b725dd96ccf46093593a4d55e1fc6550f

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 fa9860048ee0f1d5ceed282e8bbc1b2b
SHA1 52e3f76f11d0bd342c8ae7472c97a7991a20d8a8
SHA256 f48cf6535c0e5b159d49148cc886b790eb7f8b845195b89c72076f40ba495e27
SHA512 795467a298fc4f8c78b66977efcef5b65bd1d89d1967854c6abb12c329553fa729a681d88fc64d7a131a07044cb40ea15e17fb184f27920b29876e83c265d389

/data/data/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 16d25bafaad6d158417c16a475df3342
SHA1 19f5f3ca61d8e6187df7e380d2101d29617b6096
SHA256 fdf55fb5d0d0c487f44f35136c21584ba466445659653dccbf647d68b789d051
SHA512 f197c7ab1d5fbe0baa123a69dc07daa3b1f5e083993745fa190547601ef4109853f6476efc9ce00cb6d5ee60f1a204157be5081cd312b93caef3dc97574fbadd

/data/data/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/a0681934-911f-475e-8a16-fe20e6c96a3e.jobs

MD5 5368438bee84aa0087eb3402bd4fbd52
SHA1 508107b1beda708e87c280282e8ae79d4792f050
SHA256 5db44f7d7a7aa86410c61d27606093df80191cd44e19af58109b3e0bd62b4fae
SHA512 cf5115edff37896699b921cbdbc85ca6000312f5ca32785cb22e9d84f171488447d256941740b115b704ba3c9de7123f2dfe7f8df1e7a963d8afce5e5a57bfe1

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-23 13:57

Reported

2023-12-25 06:15

Platform

android-x64-arm64-20231215-en

Max time kernel

2677824s

Max time network

131s

Command Line

ir.online.afragroup

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.online.afragroup

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 udp
GB 142.250.200.46:443 udp
GB 142.250.179.238:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 1.1.1.1:53 nayrica.com udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 67.225.218.22:443 nayrica.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 142.250.200.4:443 tcp
GB 142.250.200.4:443 tcp
GB 142.250.200.4:443 tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp

Files

/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 e0267c762b801ac41fe7ddfb6ebb44a8
SHA1 b6b1bf03764f221936ff2a6ad03b4594ad2813ed
SHA256 83b468d41e1d578f907a32858204456f7e3de0fd4f249615a7ea344eaba12182
SHA512 298e98a699f5deeb2e391478c3a7fdeaed4b36bb5a640be0d84c729b3660be4d0b447555e8a2cdcd7cebde3237b097ebc3c85a3918aa968516707a5884d2d583

/data/user/0/ir.online.afragroup/databases/db_default_job_manager

MD5 437c8101498d4457b964154449abfb7b
SHA1 b5890fa98d457b6bad93a7b6f33c7dbdb7500311
SHA256 9ace808f401c0fc884db282a4cd2e0bc9bc6e13e8314d111ff54311b329f2879
SHA512 dad6fc3a1ea56f175854f69a5901c7b52c4f0184859697ae65b784df0fdbb882ae079fd745f43935c051b4bb472da9c3afde291569b137ffce0163dcc7273606

/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 2f6c12b7107e27d64852b10f46deaa05
SHA1 a4b467d093f6bfc0593bf392de5078df107d5333
SHA256 4574ae11341da346e4ad50386426efd1dbea52264ba57923635ccecbc6c8a4f6
SHA512 cd16be0032b6387edcb32f5db0799de7a489a87b20f2b41d58675d717e8268bc21c39ea0ce07726cebe100b083f2fa99d2ea9b5965b6ba02b67e9394056bdd91

/data/user/0/ir.online.afragroup/no_backup/com.google.InstanceId.properties

MD5 0d4667e96b3a537a4bce4e8faa7984f2
SHA1 5e8e709dab8eabd70d7bf50adfdf20045e9fb8eb
SHA256 44cd8b8c8bd24330edb13cb04e3d006f95ee9a97be2fe9c79af5c0fce9acd22f
SHA512 2496d8e91382227e4fc7ed251f4fe154df34af8fc42790bd4974002961f4317a903a5b5d1ee11e24e2ae22ceed2e3be468be72862e245e3f68a625f2dd754651

/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 fe81d5f4965b4620bac859af17952414
SHA1 339ab0893740245295799601d52f10313d7c96ca
SHA256 5804c301e1046629b7efa4e85242396daf3f9232c8db9cc2de0bc8d554b3be52
SHA512 ea64a9680bea4f983f867fe330908b201d015ac27b75d31fff405806049dc83bf4439870ad9f09b3f15743391b84870294a5ce1899459095c36dc38b17e94739

/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/13744a07-55f4-473e-accd-20a4dda7a99b.jobs

MD5 90f2c078efc9019bf8e6b2e8aea33015
SHA1 ee5c35cc2b5766222f7241bef3fe58c71e58b970
SHA256 5a7c532fb11ad91a174fa2ec6d6e869135d913fa795182f09f06c1d02e3150ee
SHA512 355e40f5dd3ed0791539d405f72e315ec6d1fc06b2fd3ad49fb3c0d71369307c5d803ad8a9a828bbc04706db35ae42c3ecbfdf350ee4b6e0df801dc331935dcb

/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 3351bd00ec06d2ead98970f7c86bf139
SHA1 8c89c90043457844c33286ac0ab275d7cb9ac2f6
SHA256 9c66ac7e5d64019b9036eebc93386c1267ca5aa1a40c8ee36fc347e111c6fe6f
SHA512 485b4f3f43a75d4222f9b6ab4cb1bb0a5b9ea42c7acfb850e88b6d9fc06975186cba4c11a072908955516a370be5aba89456aed0cb694ba8e202459ef698d27b

/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/fe5a9e35-a8b4-4c1f-95c8-09cda4db0ee4.jobs

MD5 427dd503a5eb5c6dea198ef16aa4f04c
SHA1 c77e0224563605e6473e78123805e5ca1ae77149
SHA256 b59c3040a91457bf80571b85a1e750846600ca7c27f07372900cda08580f43c5
SHA512 a6fc1a998e21644571fe5322b9c14a56f1d2b962505e70a402ce77efba9d6689c52b43234f151c4737f7a8a9ea442224e430bbade8fa5378e4786deabb32b670

/data/user/0/ir.online.afragroup/databases/db_default_job_manager-journal

MD5 c9306a444aabbf643f65cb67e5ab4698
SHA1 51058466068ddd27b1198a142f91180db79b337d
SHA256 fd26188c04543aaac12aaddbf5b8fde3f8e611f691de55a05ac3bc782e416a81
SHA512 1ea03c3b6c60365851328afeab74dcbad1a8487531135f256cdf7ce42805eec5b312c3ab812e06d958cf913a01adb2512b9316516cbc96ae6b325a09859dc849

/data/user/0/ir.online.afragroup/databases/cheshdb-journal

MD5 7b333247fce4cbe5bcc3db7ee2a0e536
SHA1 47a33c827f2055f46b635e776370e0f1dcc2482c
SHA256 f09f73a2c178534a21b194f2d15c53ef6b08a790127f1257bacac72bc429a4ab
SHA512 19dff7f0d8d03b06552e54d6cc9e2c45a5363932c8c135cc197f2e0a48a7f20dd6f85ad2a799c8fa645ad81cc7343d979c0c4ca9837c9d1b42c4fc763deb698d

/data/user/0/ir.online.afragroup/databases/cheshdb

MD5 f41f531c07d4141546a531ff9caffdcd
SHA1 9dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5
SHA256 bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646
SHA512 e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db-journal

MD5 df5b7c06802a28ffdc76fdfea83059ae
SHA1 8d13762395e857d71f1cf6ba4364abd47a008c9e
SHA256 27088643d9c3c8b8eb29b88f04f68ec3f5df236bce5a3df292a40913c2fbb310
SHA512 c0946b4af87ea243c961f5a676451983f8a836e6cc85d0e237ec4ebe3c7dd5f0d65639c3c1a6ec6f3d643515a816527bd32e4415af2a4a35285ceca86ca3349c

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 f1a190472ce7f42880211697876b4e35
SHA1 71bf89185aa80fbf8eae473058c146b3c2a7f32e
SHA256 b07362724a2374124dab26fd39c488460f18912b399a4e40de022085aae1c6bf
SHA512 93381130af3c39f118563e49b91110bd71c0936c99a4c84afc49f13261e3c1b2f24925f076b7f107444fedee5eb02703d10db52fa21f76027ea4d7f78969f5bf

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 1ac62172f61570cc6407117fb9c36f5d
SHA1 285cea0205e15538243ad80c37b19046c0d8d4be
SHA256 bfd92fe4a62183f2eafabea9359f394508eca7621efbe67a2ddf2556881c70d8
SHA512 a9fa87de6c6e646612201310365b9d7b2cbb0d02a90dcd6fb5f56b7674c8a0affca2eeb2b45cccbdafeac23cea022d8cc2ec3e92f2471d1d5f4c2b6fa9b722c4

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 744f972b406ef51bf92fe313fcff7779
SHA1 596dc5d7bed947fe257b3fe1fe3c5e9dd44830dd
SHA256 d9d6210273d3a2fd6f2dcd2baac86181502bd4941efcd07da3ecd82d43dcd95b
SHA512 d4300693bf2ff8ae6f9277399cd7ad48f2f43ee381200073ac548eabb01cf0b2d42710e182204dd194d017656116b88cefcaa96a2eb3c11bd8fbd7e1d1b96fdb

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 6fb71cb73e37eec316a3107d34cc857d
SHA1 4ed90100abc4cb0746e301752a9ac9410f6a803e
SHA256 31e1c2ccb53caff11853af8c22fda8d67b62e621082b9665d835e1abf9bebf58
SHA512 f8089291d2251e500ab8e932e642f1de19b33cf790c3522d8a5a48284406cea9af252a59dd64575ecab55e2bdf039466e457e5f6bc503579431276cb1127c123

/data/user/0/ir.online.afragroup/databases/google_app_measurement_local.db

MD5 8d0cd16581ff038bbc5e88cff4e8ad97
SHA1 af55a06a1a75e0c5505b71c89a4959095fca7b51
SHA256 bc034e9e3e9900bd23acd68a09598e0f4fc6b44bbf09c889e1f21ee4a6094e89
SHA512 d3aabd95a96fb1a86bb7623b90df3cd435f2897f59926296d8df1a13616b7f1570562648777a3706cd62681367727247e006f9dc503868d660e87ab7e6ea612e

/data/user/0/ir.online.afragroup/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/12965bae-239c-49ca-b050-26e2144c4919.jobs

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e