irata | e711c165643168c7c547fd5833f8458f[.]bin

General

Target
e711c165643168c7c547fd5833f8458f.bin
Size 2.9MB
Sample240115-eel7vshge4
SHA256 5187413ec4689013fb59e0a0b65b48f90cbc0f4f8e78a5b53d8ca515c129f043
MD5 1f89311af3dd92e30d2d9ee05484cf6f
SHA1 69da5dd954613cb400722e4db1d376d9da67d3f7
SHA512 2f81254f42721aace2adea05f9092d07fd0e62290a14e8265c79133a8f634f670852cc0123f30b7cac1e8f4b24288a7223bf7df42c2bf5ca389129be02bcbfd2
SSDEEP 49152:X81Cs0knqtdqL9UQaPV/qyENOnxL/NJ/YuFnmqXBTjB4sklcNey8hv5:X8mkCE8JENOnxL/NDMqxp4s+cNKhv5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
static1/unpack001/5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2.apk	family_irata4

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS

File Explorer

e711c165643168c7c547fd5833f8458f.bin

.zip 2.9MB
5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2.apk

.apk 3.9MB

e711c165643168c7c547fd5833f8458f.bin

SHA256 5187413ec4689013fb59e0a0b65b48f90cbc0f4f8e78a5b53d8ca515c129f043
MD5 1f89311af3dd92e30d2d9ee05484cf6f
SHA1 69da5dd954613cb400722e4db1d376d9da67d3f7
SHA512 2f81254f42721aace2adea05f9092d07fd0e62290a14e8265c79133a8f634f670852cc0123f30b7cac1e8f4b24288a7223bf7df42c2bf5ca389129be02bcbfd2
SSDEEP 49152:X81Cs0knqtdqL9UQaPV/qyENOnxL/NJ/YuFnmqXBTjB4sklcNey8hv5:X8mkCE8JENOnxL/NDMqxp4s+cNKhv5
MD5 SHA1 SHA512 SSDEEP

Password

infected

5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2.apk

SHA256 5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2
MD5 e711c165643168c7c547fd5833f8458f
SHA1 d8fc959a324beaa192501f7a4f4abbb2b262dcda
SHA512 cac71beaa742ed810ae7f7899fa1443ed39281aecbccebd83d72c8f4d5fc94550f1c00222c2e5d020238d9f4bfb19911346ae9017853e45df2e6803d44ae586b
SSDEEP 98304:SWlkyUb0jyUrwe2kx3TUEl7XBkkW8st6Hx:SWlkteLx3TUEl7RyzM
MD5 SHA1 SHA512 SSDEEP

android

Irata payload

Password

infected

com.lyufo.play

e711c165643168c7c547fd5833f8458f.bin

5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2.apk

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.r8

.s8

.firebasemessaging

.f8

anywheresoftware.b4a.samples.httputils2.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.jmwcx

.r8$r8_BR

.s8$s8_BR

.firebasemessaging$firebasemessaging_BR

.f8$f8_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Signatures

File Explorer

e711c165643168c7c547fd5833f8458f.bin

5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2.apk

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.r8

.s8

.firebasemessaging

.f8

anywheresoftware.b4a.samples.httputils2.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.jmwcx

.r8$r8_BR

.s8$s8_BR

.firebasemessaging$firebasemessaging_BR

.f8$f8_BR

anywheresoftware.b4a.samples.httputils2.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider