irata | 9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084 | Triage

Sharing

General

Target

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084.bin
Size

4.5MB
Sample

240404-1w9v5sca54
MD5

99c2d9582ecc4a34e466cf71e6054e84
SHA1

bd73f00c40464602f9a16ce6aeb0cbce62fb6451
SHA256

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084
SHA512

7398dbccf7f84370280d3c6ed342c9f14e49c78a33930ab437e042f8d1baaf702d2da11c95c7430e4155081576307c64cc4db7bbf2718ba21ff68654b5c342db
SSDEEP

98304:+rrhinthin6thinyhinxdhinihinkhin8hin+r4Kx2N4tOUHKt/TFiqa1:+CrC6rCECx7CUC6CiC+r4KYatOUHY5K

Score

10^/10

irata android collection discovery evasion persistence

Malware Config

Targets

- Target
  
  9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084.bin
- Size
  
  4.5MB
- MD5
  
  99c2d9582ecc4a34e466cf71e6054e84
- SHA1
  
  bd73f00c40464602f9a16ce6aeb0cbce62fb6451
- SHA256
  
  9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084
- SHA512
  
  7398dbccf7f84370280d3c6ed342c9f14e49c78a33930ab437e042f8d1baaf702d2da11c95c7430e4155081576307c64cc4db7bbf2718ba21ff68654b5c342db
- SSDEEP
  
  98304:+rrhinthin6thinyhinxdhinihinkhin8hin+r4Kx2N4tOUHKt/TFiqa1:+CrC6rCECx7CUC6CiC+r4KYatOUHY5K
Score

8^/10

collection discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectiondiscoveryevasionpersistence

behavioral2

collectiondiscoveryevasionpersistence

behavioral3

collectiondiscoveryevasionpersistence