irata

Sharing

Copy URL

Twitter E-mail

General

Target

PlanetsBeta.rar
Size

71.4MB
Sample

240114-prfkysaagj
MD5

e35aeeaaf24f8a0c96cdd3847307afc7
SHA1

28be72d1e88f7b156f63d8613427007ce972f03d
SHA256

894c46b031cc83e8403cc2f81215ca4fb38ef9725409c0c385637f5a45c03962
SHA512

63824713bf2c27ab4260d86973ebd81c2d996561315da45aa44c6dd0cb73a3ab53651a2105c3b2de1bcfbf9ec6142d95c9b3d0070752dcce65676a3ea459dcfc
SSDEEP

1572864:EUEm+xdD0JDtaFNSdJ9PJTOV5v2wOXQNJMeIX/Ct13p7hG5rq:E7m+xd4j/dHPpwN2wsQJMeIX/Ct13hh5

Score

10^/10

Malware Config

Targets

- Target
  
  PlanetsBeta.exe
- Size
  
  71.3MB
- MD5
  
  06032d5863ce1df53f29a12ac5e74e54
- SHA1
  
  f2e8bcf85e51cf689ef8e5145d9d97567a963211
- SHA256
  
  40a3d63256e959e889fe72e6d3c8ca44c3dceb06766dd8e0f6496594ab0ebed2
- SHA512
  
  80232f4bd613d93614d7244e59ba754bcb1bc28aec7fbc998c5fad8f8d6c2cda62a4935f6dce8e7f3781ee3bf234d8f69a7ccda26a15cf229a040ff3fba4ba28
- SSDEEP
  
  1572864:V4/4rzOchPOnGVV6klP7NZYil6/MsLsBSEJ/10MwKztSWVkTl207:ikqcdpVUkbyi/sLsBd/VwR/Y07
Score

10^/10

irata infostealer rat trojan
- Irata
  Irata is an Iranian remote access trojan Android malware first seen in August 2022.
  trojan infostealer rat irata
- Irata payload
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  5.2MB
- MD5
  
  df37c89638c65db9a4518b88e79350be
- SHA1
  
  6b9ba9fba54fb3aa1b938de218f549078924ac50
- SHA256
  
  dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463
- SHA512
  
  93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67
- SSDEEP
  
  12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS
Score

1^/10
behavioral7 behavioral8
- Target
  
  PlanetsBeta.exe
- Size
  
  139.5MB
- MD5
  
  ffd70cd22ce1e72d24a75763301b73ba
- SHA1
  
  cdfafef2ab213946efffc543b3fbd69d1fc24339
- SHA256
  
  f72c07820e5db527d6f12355900344edc6b29c86af80f934a5d92b7fa43e82f0
- SHA512
  
  4067c5533da72c07c331588ef49ce1867b0d016537c204f51e236e1468e6099e8f1046afdbe7c8ad05d3ddc203944a7afec3e714a1ceefe60ff3a26a82185000
- SSDEEP
  
  786432:n14w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:n14kpHwQjCWv+K18CedmVvEQEpcJW
Score

7^/10
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral11 behavioral12
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  c3842fb3087cdcdb04020ac38683c289
- SHA1
  
  329dbcd4a1c79b891b200f11eb50194b85c493bc
- SHA256
  
  e79792af338d61424bac87a19c6f34f3b4bc1382345633b8d509253a0a6c2133
- SHA512
  
  069196b8006e908954e7ab16131a0d10889a0f7517eaab2423a82fe49fb9b045c0d95dbf7c08c10ddf1a21983aea4a0d207decf91baacff0884511589a57dec5
- SSDEEP
  
  49152:JcMr6+FXptsXTmgP7he370olRK+KCKyRb+kyqVZWxX0b4unfruHw:RKer0olGyByEf8
Score

1^/10
behavioral13 behavioral14
- Target
  
  libEGL.dll
- Size
  
  437KB
- MD5
  
  8352fd22f09b873193cabc2932be92f0
- SHA1
  
  5bd2b58854b279f1733c5f54ea2669ee8a888d9e
- SHA256
  
  14a4aaa010be14762edfee01fd1f6b9943471eb7a2f9011a2b5c230461cd129c
- SHA512
  
  7281e980f2e82f1cc8173d9f8387a97f6e23ec5099ed8dca02222c4e17fa4cfef59d6aa300b1cf06d502bdcf77d9a6dbb08ad6658ae0a28ae6f9f995109da0d2
- SSDEEP
  
  6144:odpiWYLBViWOSdAr1Knk2mI3LpxE0RYqowpW6VmHrtff1FI:ipvYLbiWBqrQnPxE0cKmHZ3P
Score

1^/10
behavioral15 behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  6.7MB
- MD5
  
  b6a433dc7b4030fb17bd1683a9606b6e
- SHA1
  
  0602c50532e3f13facc67bd95a048c470e88afcc
- SHA256
  
  f7ae57a1d7d3e284714ca354f5292aa9b75086489cbfba8b1f54548445b6b3e9
- SHA512
  
  b9ba2e20ec878e3acae93d8254e69374e391fd4a3d5c1833282c43896d123baa874f1088839f3bbcf05539eda0e2aeaef28d7742ab8e20ec788382501e2152b1
- SSDEEP
  
  49152:aYKj6OhH5vSqGZ/UUopyV+gsIm3H9VnT+EisbCQ12+Q6nUBnKJ/lwE2f9rgqFnka:CvSqGZaVoH9xz+TPYrijOxm
Score

1^/10
behavioral17 behavioral18
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral19 behavioral20
- Target
  
  swiftshader/libEGL.dll
- Size
  
  450KB
- MD5
  
  19dc9ee70e7765bb63a66b6826e8ecb7
- SHA1
  
  1a12f983f8b35cc2955d30657971f113c47dc164
- SHA256
  
  83d5719abee35e051d984510e1d5d9317a109031698814742b59bdbbe7d4e30f
- SHA512
  
  1fda2bcc4b2e70987ca6011ab2534007ae4f752016d29a588aaae839bb25c35e03773f220b6a8e926cf2643997e7d4c0f28743304269b2c55642ce12934def68
- SSDEEP
  
  6144:gFzcMPKWOp0q29LDwK3p3KHvDstVpphcSGbwSi6DH0hl:g2WOOqiLDrthhcSGnc
Score

1^/10
behavioral21 behavioral22
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  3.0MB
- MD5
  
  c0b36d56d83e601bf246f7709a8c5f9d
- SHA1
  
  b025a6070f7d61c7d1827856d2d4043834fd23f2
- SHA256
  
  45bb5e1f8dd87129ac0a75c78f8f29d06e3ac182a00fc5199b692068f1e05a53
- SHA512
  
  e429ae63bd8a7d5a936a638783511693e8fbbc91d97779b3d4dd3f0880f1c8a820106bfb57cf7ee6b3639f19165de87bbe127aadd81218689fc6c8fada2106d1
- SSDEEP
  
  49152:D0mOy4fytPTlZQPF/IBCfG/owBx8iqQyehF3Hn0gPD2vzFW/GyCbZpjGKiqZ/nYI:DgfyjyeelZ/YNg/Yr
Score

1^/10
behavioral23 behavioral24
- Target
  
  vk_swiftshader.dll
- Size
  
  4.4MB
- MD5
  
  de2d91476e625278c30a5f69a1892e05
- SHA1
  
  4d707f6a801611fb437f5c1cba31b0909bf41506
- SHA256
  
  02c7f0b926c64f5a19a9aacd5f94ee00be4d576486592e18acc80c0a027b05ba
- SHA512
  
  d027407539346e5aedd527f5f71de45bace6295e96a7fbefbf273c930d64a791e488e4bdf6ef8db61fc19c80cac52a6e398c2973499c6fedb1e422c3ba71f532
- SSDEEP
  
  49152:px2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:K2DtJ+wixdag
Score

1^/10
behavioral25 behavioral26
- Target
  
  vulkan-1.dll
- Size
  
  819KB
- MD5
  
  b91586bd80e057a7f62bdc4422744812
- SHA1
  
  a1df644421ece2e740e5bf0ed98b4f269fd85c39
- SHA256
  
  8ba72d98e0f78b77bda7816cd7232809d287310d34e0f1d7472b9d5fda2c6d02
- SHA512
  
  94f0a8e3e75e4803891c0fcb257052dbe0e7399772fc7a46ab802629f76ee580ed30b3678fa6bc3744c12cf9f3103bbc8276e88f6711278748148e9fbeef2053
- SSDEEP
  
  12288:ekyJJLfcn5To6PuXtLvEdGnZSss43uobIoD:JnhoR5Ed8S2ukD
Score

1^/10
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Irata payload

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30