Analysis
-
max time kernel
149s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
02-04-2024 16:39
General
-
Target
27e0ec79dbb7c7f99b43c8c01a94188d1071d1245b1745d0e066ae774c78a8f8.apk
-
Size
3.1MB
-
MD5
aa294efd44594b64eb93904dbb3c7a2c
-
SHA1
91639afbface1289c1f35ed1e822843ad75514a7
-
SHA256
27e0ec79dbb7c7f99b43c8c01a94188d1071d1245b1745d0e066ae774c78a8f8
-
SHA512
659ed5447cc8b6b79c162464e941547b63702f9387ec4b2ae01a4bea1c522ee2a66327fae35c98ea962b46feaba9ba7c8af74acb68b0f4ba90900e936f0ee43c
-
SSDEEP
98304:1eVM3OTHHj0B8GJPl1LUV9dcKUQA1QgfJRbdpA52:sVM3OvGdLMdXUb1QMRhp02
Malware Config
Signatures
-
Brata
Brata is a banking trojan malware first seen in 2019.
-
Brata payload 4 IoCs
-
Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
-
Irata payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.xd.craft.school1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xd.craft.school/app_ded/0dny2E2fYW76k9HB7B050oSyDBo2AdMu.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.xd.craft.school/app_ded/oat/x86/0dny2E2fYW76k9HB7B050oSyDBo2AdMu.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5295ed823d46c31cef4135633633daf3b
SHA1bb3569427f6e34114bce6eff08b5b283f5195393
SHA256906d5dbff4fd804294ca836d71ee7a8c1d145e2b482592458aa8413a076efe79
SHA512effb517c5c1cf11329fd0d3cde9e7999245bc51b7e7d56451eb34472e719c3cde64532a2d2cc0c234af2fb9ccf80e446c2d81c9d1f841199ec68c27450d5074e
-
Filesize
12B
MD5abdbb534c848c7edfb4a407c25b29902
SHA162380bdc3037cb5df6c3fb780aaf53073506ba31
SHA256dacfe86fd73d7f9ff41e66a923211c722392d0fa0b838b9a6bfcb0d0e45379d4
SHA512506edaee43849f8ee043930f13b45f53b80d783bb9fa1b9393fe32e0ddea61f5cb31a57d4d1b811a0d2fc6d15dcc0a8f7b1aedd288af328e032ed25884c14bbd
-
Filesize
8B
MD52e5d8aa3dfa8ef34ca5131d20f9dad51
SHA13cc1d5a427a45820b04fe30f78a972b784952460
SHA256cde0fb0dec1400c54a0f7e7eafa73624c53e4da258bbd34b3380a0defeba95c1
SHA512a0527c1de9df8c529337f73be73cf98fcde155fcf00c7522f67a4a6298b52853d9767815d8811c2a7e5e829871a5dea9174b2b7e90fb7c98a62467240dd78434
-
Filesize
7B
MD57dc22b2c6a992f0232345df41303f5ea
SHA1d6df1ab7ac275f8c7aff9d010ccfd0db08bbe2d8
SHA256ec72b9566a9c3501838ae30aeeadb527f0b7545902376fe63b7f9739a8ee4acd
SHA512e9ce661a7e6e66e4aa7e35fc8da1248f04347b8b24afc6df1d42cc05ec562ec12102dc5b3b2537be5bbe966f767b7cca2b4f38da80693d02f7f7f4e189c9137e
-
Filesize
3.8MB
MD5b579d2033bbd178950d70d6c9e1bf22b
SHA1f3490ec5a64d5b85083f9e0e5e0aac35a6c20157
SHA2566ebb7cd1ef7c69296b33c02dd5c188a576a603fe8fd25e5b75c14ee73ff46a2f
SHA5125c700935bf9a1df02ad21916cfb55bf76c20052d9103f14a1ca255246cceed7948511fd51d3b4693b2327518d504e952bbc7c0c867c54ec830411c108f0fa7c4