01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.zip
- SHA256 109d9efc48a9d4b0f80a41968258a666fe36c7a45c6530f1cf72c42e43751d8d
Password
infected
Behavioral task
behavioral1
Sample
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk
Resource
android-x86-arm-20240221-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk
Resource
android-x64-20240221-en
android-10-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk
Resource
android-x64-arm64-20240221-en
android-11-x64
2 signatures
150 seconds
General
- Target 01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.zip
- Size 1.8MB
- Sample240402-mb5h2aef5z
- SHA256 109d9efc48a9d4b0f80a41968258a666fe36c7a45c6530f1cf72c42e43751d8d
- MD5 98d4f574be1b2a7b170f94b4a4532525
- SHA1 21222524d9854dcd7cb1b21a028c20eaf1aaea21
- SHA512 6e86f6eac97248b524a9965d2805d3b4ac06a02206ce66cb8cff74eeac67a6776e92b108642502dfe0f08d5d0087f4a563a550822689479d329baaf54fe8ca6e
- SSDEEP 49152:+HC+e21JiYy3MAGoRYyo9SVPBy3YFhDM7WN7yqBm4Wy5KM1K:h21JvulqRaFxMiUm5KM1K
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Irata family
- Irata payload 1 IoCs
resource yara_rule static1/unpack001/01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk family_irata4 - Requests dangerous framework permissions 8 IoCs
description ioc Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to read SMS messages. android.permission.READ_SMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS
File Explorer
-
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.zip.zip 1.8MB
-
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk.apk 2.0MB
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk
- SHA256 01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b
- MD5 ee8dfc02c1dc19829501c2a72468a442
- SHA1 f0e8d39e9dd4c8aec55777d11ff1c98abeafa269
- SHA512 74822080cc8156e8ad5b02889fb647fe1373519178a8c551926b8890e525478c5278141c8498f9db0e7c8adca8c7d7f86bbf7c235881f30df6ffd641558de8fe
- SSDEEP 49152:AsdkkgeXwYn1lDLXbJpemlMte1je0yfRidlRkYbTAXMWFo:Lkk5XhlDLL3evte1jCkdlRkEG6
- MD5 SHA1 SHA512 SSDEEP
-
Irata payload
Password
infected
com.lyufo.play
.main
com.lyufo.play.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INTERNET
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.READ_SMS
android.permission.READ_PHONE_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.ACCESS_COARSE_UPDATES
android.permission.WAKE_LOCK
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
com.lyufo.play.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.QUERY_ALL_PACKAGES
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.GET_TASKS
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
.main
com.google.android.gms.measurement.AppMeasurementService
com.google.android.gms.measurement.AppMeasurementJobService
com.google.firebase.components.ComponentDiscoveryService
com.google.firebase.iid.FirebaseInstanceIdService
com.google.firebase.INSTANCE_ID_EVENT
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
anywheresoftware.b4a.objects.FirebaseNotificationsService
com.google.firebase.MESSAGING_EVENT
.f10
.f11
.f8
.f9
.firebasemessaging
.r8
.s8
.starter
.uninstall
anywheresoftware.b4a.samples.httputils2.httputils2service
com.google.android.gms.measurement.AppMeasurementReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION
com.google.firebase.iid.FirebaseInstanceIdInternalReceiver
.f10$f10_BR
.f11$f11_BR
.f8$f8_BR
.f9$f9_BR
.firebasemessaging$firebasemessaging_BR
android.intent.action.BOOT_COMPLETED
.jmwcx
.r8$r8_BR
.s8$s8_BR
android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SMS_RECEIVED