irata | 136efade44da726858480a9b56aab5a9509e7c04b71fec08e9b779c069632d8c | Triage

Sharing

General

Target

136efade44da726858480a9b56aab5a9509e7c04b71fec08e9b779c069632d8c.bin
Size

4.5MB
Sample

240404-1wxktabc6w
MD5

f1ae4692dfd5977fdec487bf55119008
SHA1

5469926232601e434617b7f0dce3fc22c9069a3b
SHA256

136efade44da726858480a9b56aab5a9509e7c04b71fec08e9b779c069632d8c
SHA512

1746e032d88afa9a49a4598820fd1c57ba427da43b6f186434a64b1928aef83af32912eedf18f397627ad02ef3d4bb7df7fc5ccde0478ce0e0f04d87527c3033
SSDEEP

98304:4hinthin6thinyhinxdhinihinkhin8hin+MNN90XpBzhc8Hj0CZsjhxwjT1X+1W:OCrC6rCECx7CUC6CiC+MNNIpPc8HYeOo

Score

10^/10

irata android collection discovery evasion persistence

Malware Config

Targets

- Target
  
  136efade44da726858480a9b56aab5a9509e7c04b71fec08e9b779c069632d8c.bin
- Size
  
  4.5MB
- MD5
  
  f1ae4692dfd5977fdec487bf55119008
- SHA1
  
  5469926232601e434617b7f0dce3fc22c9069a3b
- SHA256
  
  136efade44da726858480a9b56aab5a9509e7c04b71fec08e9b779c069632d8c
- SHA512
  
  1746e032d88afa9a49a4598820fd1c57ba427da43b6f186434a64b1928aef83af32912eedf18f397627ad02ef3d4bb7df7fc5ccde0478ce0e0f04d87527c3033
- SSDEEP
  
  98304:4hinthin6thinyhinxdhinihinkhin8hin+MNN90XpBzhc8Hj0CZsjhxwjT1X+1W:OCrC6rCECx7CUC6CiC+MNNIpPc8HYeOo
Score

8^/10

collection discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectiondiscoveryevasionpersistence

behavioral2

collectiondiscoveryevasionpersistence

behavioral3

collectiondiscoveryevasionpersistence