irata | 9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f[.]zip

General

Target
9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.zip
Size 2.3MB
Sample240402-mcmdvafb85
SHA256 19a121a5d544cdd1d5a6839f81bf9dd005ae73fa3b9d6f56ea179fdb746c9547
MD5 82e73f9c1d1908c803e6c2290f486831
SHA1 9079daf6bc4a471508de5e22f3a167940f00b7b1
SHA512 6f51672092b2f22e7ca7073bd7e368dd34886561e0566769af377caea1ced5d5491d508e542b7e553dc809da5c4fddd62e3f43c4a31b216d04b48ec7dc3cbead
SSDEEP 49152:BiRq2SQ+YWdeI1Ip3o1HbaT5G1cSfkymC0utY9y44rrJE9b:a5+YWdv1/5aVG1cSfkQ0C1ib
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an instant app to create foreground services.	android.permission.INSTANT_APP_FOREGROUND_SERVICE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

File Explorer

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.zip

.zip 2.3MB
9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.apk

.apk 3.4MB

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.zip

SHA256 19a121a5d544cdd1d5a6839f81bf9dd005ae73fa3b9d6f56ea179fdb746c9547
MD5 82e73f9c1d1908c803e6c2290f486831
SHA1 9079daf6bc4a471508de5e22f3a167940f00b7b1
SHA512 6f51672092b2f22e7ca7073bd7e368dd34886561e0566769af377caea1ced5d5491d508e542b7e553dc809da5c4fddd62e3f43c4a31b216d04b48ec7dc3cbead
SSDEEP 49152:BiRq2SQ+YWdeI1Ip3o1HbaT5G1cSfkymC0utY9y44rrJE9b:a5+YWdv1/5aVG1cSfkQ0C1ib
MD5 SHA1 SHA512 SSDEEP

Password

infected

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.apk

SHA256 9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f
MD5 fb469b2453333babf92789c8a05b7019
SHA1 eaa47b8dbc32ebb7d2d090f41ed6eac8793e6388
SHA512 dea36e544d2529407a9334dc7e175eebe9f060d7926db0af1400e3cb3c7505cb6d200919c5043d58322bc12fae2d36a46e55f5dec1b86eeb40f9cb3905f12519
SSDEEP 98304:RA+u4Y1sNALlOUajvXoTwr5qr5+l9ks5TJGAK86j:RAk8OdgtuJgj
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86 arch:arm64 arch:x64

Password

infected

com.drnull.v5

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.zip

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.apk

com.drnull.v5.MainActivity

com.google.android.gms.common.api.GoogleApiActivity

com.drnull.v5.SmsService

com.drnull.v5.FmService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.drnull.v5.SmsReceiver

com.drnull.v5.FmReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.zip

9334d10838e3482cb33e6130ea8397c30cc9edacd9597f1c21aa321d736cd80f.apk

com.drnull.v5.MainActivity

com.google.android.gms.common.api.GoogleApiActivity

com.drnull.v5.SmsService

com.drnull.v5.FmService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.drnull.v5.SmsReceiver

com.drnull.v5.FmReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider