77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.zip
- SHA256 2c28b815e18eeaae191f871f57d2f04ce6bc9974553684341433baf430034433
Password
infected
Behavioral task
behavioral1
Sample
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
Resource
android-x86-arm-20240221-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
Resource
android-x64-20240221-en
android-10-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
Resource
android-x64-arm64-20240221-en
android-11-x64
1 signatures
150 seconds
General
- Target 77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.zip
- Size 2.4MB
- Sample240402-mcdfyaef6z
- SHA256 2c28b815e18eeaae191f871f57d2f04ce6bc9974553684341433baf430034433
- MD5 4be00263ed7a4c4935cc0c7dce8d2a3f
- SHA1 4fb7460974ad905e1ead951f88d022b3a8894af4
- SHA512 05a420f06de85dfab531a8c46d3b8748f6b8a2ba5adde8cdb2a85c3433f58a8ca364f65ed0e73ee195c64421598994fcb251b9f1b4e920a20129e01944fab4c6
- SSDEEP 49152:eu511ANAXrE4n1g8wsqVCzd3HOTRub34uMOmQGleN:P71Y+9S9sAGJuTAb34LOmhlS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Irata family
- Irata payload 2 IoCs
resource yara_rule static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk family_irata3 static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk family_irata4 - Requests dangerous framework permissions 5 IoCs
description ioc Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS
File Explorer
-
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.zip.zip 2.4MB
-
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk.apk 2.6MB
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
- SHA256 77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042
- MD5 40981142bcde486676e5eea7bcdfadbb
- SHA1 b61860a7ef0ec87174b92c59c6b68265a32619c4
- SHA512 584e8dbd93b9d89c29d3b7180f524a1d3077cad2fc10542db15f8a604290f475ddd2ddcbabbf5a406f048d224bcadd00348abfcce39f9885a569ef6e2a9ec090
- SSDEEP 49152:J/G52p3JiUhiZu/Rtzr52jvAOpPK4Nc5hFV3MM0b9kpYgs6V/Dce7q5px671:Rvp5piZmpCvBpPKr3r8MIWpYMV/6pS
- MD5 SHA1 SHA512 SSDEEP
-
Irata payload
Password
infected
Madsal.com
.main
Madsal.com.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
Madsal.com.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_CONTACTS
.main
android.intent.action.MAIN
.main
android.intent.action.MAIN
.chrome
.mainchange
.second
.telegram
.villain
.youtube
com.google.android.gms.measurement.AppMeasurementService
com.google.android.gms.measurement.AppMeasurementJobService
com.google.firebase.components.ComponentDiscoveryService
com.google.firebase.iid.FirebaseInstanceIdService
com.google.firebase.INSTANCE_ID_EVENT
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
anywheresoftware.b4a.objects.FirebaseNotificationsService
com.google.firebase.MESSAGING_EVENT
.starter
.installrequest
.brodcast
.recivesms
.firebasemessaging
.serverurl
.smstext
.lastsms
.balance
.what
.searchsms
com.google.android.gms.measurement.AppMeasurementReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION
com.google.firebase.iid.FirebaseInstanceIdInternalReceiver
.starter$starter_BR
android.intent.action.BOOT_COMPLETED
.installrequest$installrequest_BR
android.intent.action.BOOT_COMPLETED
.brodcast$brodcast_BR
android.intent.action.BOOT_COMPLETED
.recivesms$recivesms_BR
android.provider.Telephony.SMS_RECEIVED
.firebasemessaging$firebasemessaging_BR
android.intent.action.BOOT_COMPLETED
.serverurl$serverurl_BR
android.intent.action.BOOT_COMPLETED
.smstext$smstext_BR
android.intent.action.BOOT_COMPLETED
.lastsms$lastsms_BR
android.intent.action.BOOT_COMPLETED
.balance$balance_BR
android.intent.action.BOOT_COMPLETED
.what$what_BR
android.intent.action.BOOT_COMPLETED