irata | 03528c922fede79a66c26dd6bbd67276[.]zip

General

Target

03528c922fede79a66c26dd6bbd67276.zip
Size

1.3MB
MD5

03528c922fede79a66c26dd6bbd67276
SHA1

cad51e74dc1fe4e9362a75a6c3bd17a84c1f820c
SHA256

b33b977881b6887be0107e5304e7d0ebd12f6e5625596c799daf04ae1836c4f7
SHA512

a20b2a951de1a543478dff04bef5563143e399b70c0a4cf87f5eea65d567871c19033459016c751fb23be4ec0de20a8b396e8c661c1ccfe6fb39345d46c69b21
SSDEEP

24576:pVOzLKoO5676S3mpRsvvZQImMK0TX26/NYvkZCSN7DoKZNbfwuY8:MLKoN2XsvTK0C6nCe7fDbfwuY8

Score

10^/10

irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

com.farsitel.bazaar.permission.PAY_THROUGH_BAZAAR

android.permission.RECEIVE_BOOT_COMPLETED