irata | 690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629[.]bin

General

Target
690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin
Size 3.9MB
Sample240224-1xefmafe33
SHA256 690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629
MD5 2bbe9258cbe75d77506848b272367cfd
SHA1 42fbe019f2130c1582a1103b06a18669c8f006fb
SHA512 c062f08018d82caeb11a5f8b17a1bc1235b3b9b8cce25c53496da6ce1f120994d08b340efd378868a7b690fc1201a098b33714d3442e246ff5e9459b7ca3461e
SSDEEP 98304:39cBdlOABR0OVf1skY7SLW1qghTScHVrCe7:NCVPrdoAghTzVrCo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin

.apk 3.9MB

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin

SHA256 690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629
MD5 2bbe9258cbe75d77506848b272367cfd
SHA1 42fbe019f2130c1582a1103b06a18669c8f006fb
SHA512 c062f08018d82caeb11a5f8b17a1bc1235b3b9b8cce25c53496da6ce1f120994d08b340efd378868a7b690fc1201a098b33714d3442e246ff5e9459b7ca3461e
SSDEEP 98304:39cBdlOABR0OVf1skY7SLW1qghTScHVrCe7:NCVPrdoAghTzVrCo
MD5 SHA1 SHA512 SSDEEP

android

Irata payload

com.sicurezzaapp.android

Android Permissions

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WRITE_SETTINGS

android.permission.INTERNET

android.permission.READ_PHONE_NUMBERS

android.permission.REQUEST_DELETE_PACKAGES

android.settings.NOTIFICATION_POLICY_ACCESS_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.NEW_OUTGOING_CALL

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.ANSWER_PHONE_CALLS

android.permission.READ_CALL_LOG

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NOTIFICATION_POLICY

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin

.getdefaultsms_activity

.drawer_permission_activity

.alert_manuale

.adm_activity

.permissions_activity

.fakepin_activity

.policy_permissions_activity

.vnc_activity

.notification_activity

.main

com.google.android.gms.common.api.GoogleApiActivity

.inject_activity

.permission_activity_a11y

.sms_resp

.safeyprotect

.sms_deliver

.sms_push

.locken

.managerservice

.teste_safey

.httputils2service

.h_service

.websockservice

.locken$locken_BR

.httputils2service$httputils2service_BR

.websockservice$websockservice_BR

anywheresoftware.b4a.objects.AdminReceiver2

.teste_safey$teste_safey_BR

.sms_resp$sms_resp_BR

.safeyprotect$safeyprotect_BR

.sms_deliver$sms_deliver_BR

.sms_push$sms_push_BR

.h_service$h_service_BR

.managerservice$managerservice_BR

Sharing

General

Malware Config

Signatures

File Explorer

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin

.getdefaultsms_activity

.drawer_permission_activity

.alert_manuale

.adm_activity

.permissions_activity

.fakepin_activity

.policy_permissions_activity

.vnc_activity

.notification_activity

.main

com.google.android.gms.common.api.GoogleApiActivity

.inject_activity

.permission_activity_a11y

.sms_resp

.safeyprotect

.sms_deliver

.sms_push

.locken

.managerservice

.teste_safey

.httputils2service

.h_service

.websockservice

.locken$locken_BR

.httputils2service$httputils2service_BR

.websockservice$websockservice_BR

anywheresoftware.b4a.objects.AdminReceiver2

.teste_safey$teste_safey_BR

.sms_resp$sms_resp_BR

.safeyprotect$safeyprotect_BR

.sms_deliver$sms_deliver_BR

.sms_push$sms_push_BR

.h_service$h_service_BR

.managerservice$managerservice_BR

Android Permissions

690028a51d97702496f0f09d293d51ade754bfebe343efd25d9c08a0bcb5f629.bin