irata | 674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df[.]zip

General

Target
674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.zip
Size 1.7MB
Sample240402-mccveafb79
SHA256 04fa699b1c19398dc8f060f047855c3fe6d8e03c4c2f4fc7f2272bb368771915
MD5 3339e463fdb207486ac7c36ba2b2d875
SHA1 6cef91a998db23011a4c34259bc585d17cfbde4a
SHA512 0200b0a9aee09a1d0666b391b8da3459c07904bbf013ea165cefc6d259b81a7fab572682ee1bd51380325c24f09d2fd2e4c8cf81106d4dfd1a032d23c2cf32f4
SSDEEP 24576:xqSpFi4o3+0TDBLQJPQ6pWFKkohgU4YlNreQL1TYUbCCLUOqHjUeEkMh3l+zeU1k:xyMADBLQWr3oXr/hEUbADKkM6jwc86T2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Extracted

Family

irata

C2

https://pbpbpwaw.nitro-cp.xyz/RL/contact.php?result=ok&action=upload&androidid=
https://pbpbpwaw.nitro-cp.xyz/RL/requests.php
https://pbpbpwaw.nitro-cp.xyz/RL/sms.php?result=ok&action=upload&androidid=

Signatures

Irata family
irata

Irata payload 2 IoCs

resource	yara_rule
static1/unpack001/674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk	family_irata1
static1/unpack001/674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk	family_irata4

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

File Explorer

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.zip

.zip 1.7MB
674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk

.apk 1.9MB

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.zip

SHA256 04fa699b1c19398dc8f060f047855c3fe6d8e03c4c2f4fc7f2272bb368771915
MD5 3339e463fdb207486ac7c36ba2b2d875
SHA1 6cef91a998db23011a4c34259bc585d17cfbde4a
SHA512 0200b0a9aee09a1d0666b391b8da3459c07904bbf013ea165cefc6d259b81a7fab572682ee1bd51380325c24f09d2fd2e4c8cf81106d4dfd1a032d23c2cf32f4
SSDEEP 24576:xqSpFi4o3+0TDBLQJPQ6pWFKkohgU4YlNreQL1TYUbCCLUOqHjUeEkMh3l+zeU1k:xyMADBLQWr3oXr/hEUbADKkM6jwc86T2
MD5 SHA1 SHA512 SSDEEP

Password

infected

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk

SHA256 674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df
MD5 4147904fb544e009e685e4287f07c1cc
SHA1 bcd73656e0cd57207350c7f760e2d12be2e0ed9f
SHA512 8b2a9be442ecdae71a8435c485fb3be4a1c4dfb55d0a5d3fd8ee656ff2d9f5d9e8331c296779b93bd1b8a4355a92cc5338de694ed96636ad5bb286251c8e78fd
SSDEEP 49152:k/NO7Sk5k6/Pcp7zDsvWF/EpopXanlGpdWvtbB/Wx9PgR:yI+z6chzQvq/EehaMOvr/WnI
MD5 SHA1 SHA512 SSDEEP

android

Irata payload

Password

infected

kisi.com

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.zip

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.zip

674311b16307f337b352940bbaa796db58638dd402cb27c42569cc7ebb79a0df.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.firebasemessaging

.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider