irata | 57f75ad95573f857fcfe13aaa3847511

General

Target

57f75ad95573f857fcfe13aaa3847511
Size

2.0MB
MD5

57f75ad95573f857fcfe13aaa3847511
SHA1

06c78273196985b2c2a377624709c7a1a42bfe1f
SHA256

d333fda60b5f62c61be6214e64fe79ee78c66bdd1f995736aeeb33cddc7494ea
SHA512

45933fffed33fe3fd918be295e2de337c6cc06f18ac6c35c5c82d05513b90ab0d19fc133de9372be870acb705b306512e5969adf2627e07f93f79f8505553c4e
SSDEEP

49152:W0wm8uToZIx+HmXzh0FDe2PLWXJdm+Mb3Zqw:bwFUoZIx1Y61Mb4w

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS

Files

57f75ad95573f857fcfe13aaa3847511
.apk android

es.adadda.ujd

.main

Activities

.main

android.intent.action.MAIN

Permissions

android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.VIBRATE
android.permission.RECEIVE_SMS
android.permission.WAKE_LOCK
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.CAMERA
android.permission.READ_PHONE_STATE
android.permission.SYSTEM_OVERLAY_WINDOW
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.WRITE_SETTINGS
android.permission.READ_CONTACTS
android.permission.CALL_PHONE
android.permission.READ_SMS

Receivers

.starter$starter_BR

android.intent.action.BOOT_COMPLETED

.bulacha$bulacha_BR

android.intent.action.BOOT_COMPLETED

Services

.bulacha

android.accessibilityservice.AccessibilityService

Android Permissions

57f75ad95573f857fcfe13aaa3847511

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.VIBRATE

android.permission.RECEIVE_SMS

android.permission.WAKE_LOCK

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.WRITE_SETTINGS

android.permission.READ_CONTACTS

android.permission.CALL_PHONE

android.permission.READ_SMS

Sharing

General

Malware Config

Signatures

Files

es.adadda.ujd

.main

Activities

.main

Permissions

Receivers

.starter$starter_BR

.bulacha$bulacha_BR

Services

.bulacha

Android Permissions

57f75ad95573f857fcfe13aaa3847511