irata | 1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847 | Triage

Sharing

General

Target

1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847.bin
Size

3.1MB
Sample

240413-1wpvzaad46
MD5

68ee0fd56511f904fc45882f974a0f7b
SHA1

faa1582fc352a495b02de0cd43a9d4c05987253d
SHA256

1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847
SHA512

3e68f71a2849539a1b7176725796f5f5b2023252be82d4b85cace0c1b5cb6555c0e46f6fc694816d68af65d5d9c583ffe46fecc703e897aa41d0d2891b6b3d75
SSDEEP

98304:BRVqKyHGwhXCUzTIDPwMZ6hyoiIm1rZdr4fc/gg:EVmwhX1TIrsm1VgE

Score

10^/10

irata android discovery evasion persistence

Malware Config

Targets

- Target
  
  1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847.bin
- Size
  
  3.1MB
- MD5
  
  68ee0fd56511f904fc45882f974a0f7b
- SHA1
  
  faa1582fc352a495b02de0cd43a9d4c05987253d
- SHA256
  
  1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847
- SHA512
  
  3e68f71a2849539a1b7176725796f5f5b2023252be82d4b85cace0c1b5cb6555c0e46f6fc694816d68af65d5d9c583ffe46fecc703e897aa41d0d2891b6b3d75
- SSDEEP
  
  98304:BRVqKyHGwhXCUzTIDPwMZ6hyoiIm1rZdr4fc/gg:EVmwhX1TIrsm1VgE
Score

7^/10

discovery evasion persistence
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasionpersistence

behavioral3

discoveryevasion