irata | 92624244ee4834560efedb66224b16ab

General

Target

92624244ee4834560efedb66224b16ab
Size

1.9MB
MD5

92624244ee4834560efedb66224b16ab
SHA1

1729594ac913508bd8083a36dbfe8bcee2096805
SHA256

c7e3cc7e5fc9a82f02939769b986f5c9ae3ed1b3a88fa24c2c26c7b1d042fb60
SHA512

8a29cbcc9d33a0a7ea51c090a6212f86f83faf808277d4a18b467d7022394a1a31655489a5ad93318ee2a4ac3785c2eeab5b2d90f89b6a64f3d43cb15e7d98fc
SSDEEP

49152:e0wmpuToZIx+HmXrKRbGaGwSSRhPqvzq0zFU1B/cP:Dw4UoZIx1bdqvRF4F0BI

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

Processes:

resource	yara_rule
sample	family_irata4

Declares services with permission to bind to the system 1 IoCs

Processes:

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 9 IoCs

Processes:

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS

Files

92624244ee4834560efedb66224b16ab
.apk android

es.adadda.ujd

.main

Activities

.main

android.intent.action.MAIN

Permissions

android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.VIBRATE
android.permission.RECEIVE_SMS
android.permission.WAKE_LOCK
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.CAMERA
android.permission.READ_PHONE_STATE
android.permission.SYSTEM_OVERLAY_WINDOW
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.WRITE_SETTINGS
android.permission.READ_CONTACTS
android.permission.CALL_PHONE
android.permission.READ_SMS

Receivers

.starter$starter_BR

android.intent.action.BOOT_COMPLETED

.bulacha$bulacha_BR

android.intent.action.BOOT_COMPLETED

Services

.bulacha

android.accessibilityservice.AccessibilityService

Android Permissions

92624244ee4834560efedb66224b16ab

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.VIBRATE

android.permission.RECEIVE_SMS

android.permission.WAKE_LOCK

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.WRITE_SETTINGS

android.permission.READ_CONTACTS

android.permission.CALL_PHONE

android.permission.READ_SMS

Sharing

General

Malware Config

Signatures

Files

es.adadda.ujd

.main

Activities

.main

Permissions

Receivers

.starter$starter_BR

.bulacha$bulacha_BR

Services

.bulacha

Android Permissions

92624244ee4834560efedb66224b16ab