irata | 91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a | Triage

Sharing

General

Target

91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a.bin
Size

4.6MB
Sample

240417-1w3f3afe24
MD5

b3f067b4dfea589351b3f5f25dfb1b3c
SHA1

4982a6e134a829373ac75c988b8f1717bb0782ef
SHA256

91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a
SHA512

14190a172461475458621a483e9b47cd6d8b0dee138e7d07cc8ac3e1ffbbf4d910ea61fb86ae5a80a5f88e1b4de4a5a90f18bf7d37f3996529d5e8d1bedae30a
SSDEEP

98304:x9hinlhin6Vhinahinx1hin6hinshinUhinyPSw9UwwriyP1qwgOBpOeaD18E/p:xbCzC6DC8CxjCcCyCKCy9UwwrtgfOBps

Score

10^/10

irata android collection discovery evasion persistence

Malware Config

Targets

- Target
  
  91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a.bin
- Size
  
  4.6MB
- MD5
  
  b3f067b4dfea589351b3f5f25dfb1b3c
- SHA1
  
  4982a6e134a829373ac75c988b8f1717bb0782ef
- SHA256
  
  91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a
- SHA512
  
  14190a172461475458621a483e9b47cd6d8b0dee138e7d07cc8ac3e1ffbbf4d910ea61fb86ae5a80a5f88e1b4de4a5a90f18bf7d37f3996529d5e8d1bedae30a
- SSDEEP
  
  98304:x9hinlhin6Vhinahinx1hin6hinshinUhinyPSw9UwwriyP1qwgOBpOeaD18E/p:xbCzC6DC8CxjCcCyCKCy9UwwrtgfOBps
Score

8^/10

collection discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectiondiscoveryevasionpersistence

behavioral2

collectiondiscoveryevasionpersistence

behavioral3

collectiondiscoveryevasionpersistence