irata | 27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17

General

Target

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
Size

13.9MB
MD5

3066a29cab8d9059911f2fbc635bc886
SHA1

6177d45743e5dcc657d54f8a42fb57b230866ff2
SHA256

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
SHA512

47d3921613802e47795fbd10225a67e76fad7ae1931e57c01aeb422ed5ba59ae6863840588be4fd294d7bdee5bf5d4e18f2942e235518a1fc1a07614076e7aa6
SSDEEP

393216:AOH7UcX48VL4d3HUvsq6CilmIDeeSeAQxSAlRum4uEM:AOpX48p4Z0vsqH4mSSeAQxSAlRT4ub

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Files

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17
.apk android

ir.online.afragroup

.main

Activities

.main

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.VIBRATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
ir.online.afragroup.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION

me.cheshmak.android.sdk.core.receivers.AlarmReceiver

android.intent.action.TIME_SET
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.DELETE
me.cheshmak.intent.action.SEND_EVENT

me.cheshmak.android.sdk.core.receivers.RemoteReceiver

CHESH_REMOTE_DATA_ACTION

me.cheshmak.android.sdk.core.network.AppStartReceiver

me.cheshmak.start
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON

me.cheshmak.android.sdk.core.receivers.AppChangeListener

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

.starter$starter_BR

android.intent.action.BOOT_COMPLETED

.cheshmakservice$cheshmakservice_BR

android.intent.action.BOOT_COMPLETED

.firebasemessaging$firebasemessaging_BR

android.intent.action.BOOT_COMPLETED

Services

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

b4a.cheshmak.wrapper.CheshmakWithFirebaseService

com.google.firebase.MESSAGING_EVENT

me.cheshmak.android.sdk.core.job.FirebaseJobService

com.cheshmak.jobdispatcher.ACTION_EXECUTE

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

Android Permissions

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

ir.online.afragroup.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

Sharing

General

Malware Config

Signatures

Files

ir.online.afragroup

.main

Activities

.main

Permissions

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

me.cheshmak.android.sdk.core.receivers.AlarmReceiver

me.cheshmak.android.sdk.core.receivers.RemoteReceiver

me.cheshmak.android.sdk.core.network.AppStartReceiver

me.cheshmak.android.sdk.core.receivers.AppChangeListener

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

.starter$starter_BR

.cheshmakservice$cheshmakservice_BR

.firebasemessaging$firebasemessaging_BR

Services

com.google.firebase.iid.FirebaseInstanceIdService

b4a.cheshmak.wrapper.CheshmakWithFirebaseService

me.cheshmak.android.sdk.core.job.FirebaseJobService

com.google.firebase.iid.FirebaseInstanceIdService

Android Permissions

27ed8b8ad6a58a8e9230f131ed48ff49128de23ae260840e92aab0902b633a17