irata | 30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4[.]zip

General

Target
30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.zip
Size 1.8MB
Sample240402-mb7ndsfb66
SHA256 9ab480c3dc42f9e5f1265bcce9ae752a3ce97ae7108efc97b8ad05c5490ad8d8
MD5 b1d10a60844fb27b9b4f613e370de825
SHA1 0566db139634d629e111d6047079612a21f5d41a
SHA512 358e55b38bd9fcdeb76a4c5e5fe381907d56d747f711b6560dd965df9297c317fbed5e97ea5e7597682bdbaead5c134296428a138ab1311ee804b3f37f9dc136
SSDEEP 49152:88M0gmRCWXrnVdkg+YnhBRxGsL0eVcrWvNOVcrNFMc:1M0gm1Xr3kpYnhB+st28OVc0c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Extracted

Family

irata

C2

https://rat-remote.online/data/6418791312/rat/3198ZYVa/contact.php?result=ok&action=upload&androidid=
https://rat-remote.online/data/6418791312/rat/3198ZYVa/requests.php
https://rat-remote.online/data/6418791312/rat/3198ZYVa/sms.php?result=ok&action=upload&androidid=

Signatures

Irata family
irata

Irata payload 2 IoCs

resource	yara_rule
static1/unpack001/30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk	family_irata1
static1/unpack001/30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk	family_irata4

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

File Explorer

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.zip

.zip 1.8MB
30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk

.apk 1.9MB

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.zip

SHA256 9ab480c3dc42f9e5f1265bcce9ae752a3ce97ae7108efc97b8ad05c5490ad8d8
MD5 b1d10a60844fb27b9b4f613e370de825
SHA1 0566db139634d629e111d6047079612a21f5d41a
SHA512 358e55b38bd9fcdeb76a4c5e5fe381907d56d747f711b6560dd965df9297c317fbed5e97ea5e7597682bdbaead5c134296428a138ab1311ee804b3f37f9dc136
SSDEEP 49152:88M0gmRCWXrnVdkg+YnhBRxGsL0eVcrWvNOVcrNFMc:1M0gm1Xr3kpYnhB+st28OVc0c
MD5 SHA1 SHA512 SSDEEP

Password

infected

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk

SHA256 30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4
MD5 6d2a244b9f0f6bebe60b3ece6e54a289
SHA1 0a2f59224c58ef6451507145ddf217dba631771b
SHA512 e8c5f670e1ee4e401e28c74c316aed0cef7d5007ce7c3e5eebaf26bba1205cc79cf88c5e57aab499dece08649f7d93392353314590805589c5d223a9c78d9f44
SSDEEP 24576:x/cDcvb6Tpm4AsRiQci7JQBaib5LbX3zj/jEJubhsmqecEZD/INFky6X6XR+XgCi:x/Lb2AZDi7JQMULTr+ub1zZkNFkyvQQ5
MD5 SHA1 SHA512 SSDEEP

android

Irata payload

Password

infected

Mad1sal.com

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.zip

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.zip

30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider