irata | 6e7a2ce4e84d3902614490971e3cd58e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
6e7a2ce4e84d3902614490971e3cd58e_JaffaCakes118
Size 31.4MB
Sample240524-pc65csab4v
SHA256 89045f7c687bd704e7c06e065bb0c2371bbadbc9a702b2c75944cdcbbcf153ad
MD5 6e7a2ce4e84d3902614490971e3cd58e
SHA1 2704b4dc51c3b31a6df74dc993b6144d2eb62303
SHA512 b5b720da1ed3a9c2375aba0694628a12b77f0253f2129e2cb4a8894946a9647173d08f747b8aab17faad527fb152403dc67cf7ddafde3028f59d1df7a2c67e0e
SSDEEP 786432:0ZuIJzWNSJwAona707SNhfXPUaucJX/UyJzCSiE:iuIJzWNSJwHa47SfMau6X/Uy9X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS

File Explorer

6e7a2ce4e84d3902614490971e3cd58e_JaffaCakes118

.apk 31.4MB
gdtadv2.jar

.apk 468KB

6e7a2ce4e84d3902614490971e3cd58e_JaffaCakes118

SHA256 89045f7c687bd704e7c06e065bb0c2371bbadbc9a702b2c75944cdcbbcf153ad
MD5 6e7a2ce4e84d3902614490971e3cd58e
SHA1 2704b4dc51c3b31a6df74dc993b6144d2eb62303
SHA512 b5b720da1ed3a9c2375aba0694628a12b77f0253f2129e2cb4a8894946a9647173d08f747b8aab17faad527fb152403dc67cf7ddafde3028f59d1df7a2c67e0e
SSDEEP 786432:0ZuIJzWNSJwAona707SNhfXPUaucJX/UyJzCSiE:iuIJzWNSJwHa47SfMau6X/Uy9X
MD5 SHA1 SHA512 SSDEEP

android arch:arm

Irata payload

com.jovetech.CloudSee.temp

android.permission.RECEIVE_BOOT_COMPLETED android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.READ_PHONE_STATE android.permission.INTERNET android.permission.CHANGE_CONFIGURATION android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.CHANGE_WIFI_STATE android.permission.VIBRATE android.permission.INTERACT_ACROSS_USERS_FULL android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_EXTERNAL_STORAGE android.permission.RECORD_AUDIO android.permission.READ_LOGS android.permission.GET_TASKS android.permission.SYSTEM_ALERT_WINDOW android.permission.CAMERA android.permission.FLASHLIGHT android.permission.WAKE_LOCK android.permission.DISABLE_KEYGUARD android.permission.MODIFY_AUDIO_SETTINGS android.permission.CALL_PHONE android.permission.REORDER_TASKS android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_COARSE_LOCATION android.permission.WRITE_EXTERNAL_STORAGE android.permission.GET_TASKS android.permission.SYSTEM_ALERT_WINDOW com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT com.android.launcher.permission.CREATE_SHORTCUT android.permission.GET_ACCOUNTS android.permission.USE_CREDENTIALS android.permission.MANAGE_ACCOUNTS android.permission.AUTHENTICATE_ACCOUNTS android.permission.WRITE_SYNC_SETTINGS com.android.browser.permission.READ_HISTORY_BOOKMARKS android.permission.WRITE_SETTINGS android.permission.MANAGE_USERS android.permission.REQUEST_INSTALL_PACKAGES android.permission.FLAG_GRANT_READ_URI_PERMISSION getui.permission.GetuiService.com.jovetech.CloudSee.temp android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.SYSTEM_OVERLAY_WINDOW android.permission.PACKAGE_USAGE_STATS android.permission.ACCESS_COARSE_UPDATES

com.jovision.welcome.JVWelcomeActivity

android.intent.action.MAIN

com.qq.e.ads.ADActivity

com.kyview.AdviewWebView

com.kyview.AdActivity

com.jovision.welcome.JVGuidActivity

com.jovision.main.JVNewFuncGuideActivity

com.jovision.login.JVLoginGuideActivity

com.jovision.login.JVLoginActivity

com.jovision.main.JVMainActivity

com.jovision.about.JVAboutActivity

com.jovision.main.TestActivity

com.jovision.set.JVSetActivity

com.jovision.album.JVAlbumActivity

com.jovision.adddevice.JVAddDeviceActivity

com.jovision.adddevice.JVAddLineDeviceAcitivity

com.jovision.main.JVEditDeviceActivity

com.jovision.main.JVChannelActivity

com.jovision.adddevice.JVAddScanDeviceActivity

com.jovision.login.JVRegisterActivity

com.jovision.login.JVRegisterRegistActivity

com.jovision.login.JVFindPWDMainActivity

com.jovision.login.JVFindPWDActivity

com.jovision.about.JVSpitActivity

com.jovision.album.JVAlbumListActivity

com.jovision.album.JVAlbumShowCaptureActivity

com.jovision.album.JVAlbumDetailActivity

com.jovision.usercenter.JVUserCenterActivity

com.jovision.usercenter.JVVerifyAccountActivity

com.jovision.usercenter.JVCropActivity

com.jovision.usercenter.JVUsercenterBindActivity

com.jovision.usercenter.JVUsercenterChangeBindActivity

com.jovision.usercenter.JVResetPwdActivity

com.jovision.usercenter.JVUserCenterNickNameActivity

com.jovision.set.JVSetPushActivity

com.jovision.web.JVWebViewActivity

com.jovision.web.JVWebViewNativeActivity

com.jovision.alarm.JVDevAlarmListActivity

com.jovision.alarm.JVDev2AlarmListActivity

com.jovision.login.JVGuestDataMoveActivity

com.jovision.secret.JVSecretActivity

com.jovision.login.JVGuestActivity

com.jovision.login.JVGuestDeviceConnDetailActivity

com.jovision.secret.JVAgentActivity

com.jovision.main.JVSearchActivity

com.jovision.adddevice.JVAddWifiDeviceActivity

com.jovision.main.JVHelperActivity

com.jovision.ap.JVApConnActivity

com.jovision.main.JVFeedbackSpecialActivity

com.iflytek.voiceads.request.IFLYBrowser

com.qq.e.ads.ADActivity

com.qq.e.ads.PortraitADActivity

com.qq.e.ads.LandscapeADActivity

com.jovision.guest.GuestActivity

com.jovision.guest.main.JVMainActivity

com.jovision.guest.main.JVEditDeviceActivity

com.jovision.guest.main.JVChannelActivity

com.jovision.guest.main.JVSearchActivity

com.jovision.guest.main.JVHelperActivity

com.jovision.guest.adddevice.JVAddDeviceActivity

com.jovision.guest.adddevice.JVAddLineDeviceAcitivity

com.jovision.guest.adddevice.JVAddScanDeviceActivity

com.jovision.guest.adddevice.JVAddWifiDeviceActivity

com.jovision.guest.album.JVAlbumActivity

com.jovision.guest.album.JVAlbumListActivity

com.jovision.guest.album.JVAlbumShowCaptureActivity

com.jovision.guest.album.JVAlbumDetailActivity

com.jovision.guest.web.JVWebViewActivity

com.jovision.guest.about.JVAboutActivity

com.jovision.guest.set.JVSetActivity

com.jovision.play.ui.JVPlayActivity

com.jovision.play.ui.JVPlayFaildReasonActivity

com.jovision.play.ui.JVRemoteListActivity

com.jovision.play.ui.JVRemotePlayBackActivity

com.jovision.play.ui.JVRemotePlayActivity

com.jovision.play.ui.JVRemoteLinePlayActivity

com.jovision.play.devsettings.JVDevSettingsMainActivity

com.jovision.play.devsettings.JVDevSettingsAlarmActivity

com.jovision.play.devsettings.JVDevSettingsZoneActivity

com.jovision.play.devsettings.JVDevSettingsSystemActivity

com.jovision.play.devsettings.JVDevSettingsStorageActivity

com.jovision.play.devsettings.JVDevSettingsApStorageActivity

com.jovision.play.devsettings.JVDevSettingsVersionActivity

com.jovision.play.devsettings.JVDevSettingsOthersActivity

com.jovision.play.devsettings.JVDevSettingsAlarmTimeActivity

com.jovision.play.devsettings.JVDevSettingsAlarmThirdActivity

com.jovision.play.devsettings.JVDevSettingsZoneTimeActivity

com.jovision.play.devsettings.JVDevSettingsZoneSetActivity

com.jovision.play.devsettings.JVDevSettingsNickNameActivity

com.jovision.play2.ui.JVPlayActivity

com.jovision.play2.ui.JVPlayFaildReasonActivity

com.jovision.play2.ui.JVRemotePlayActivity

com.jovision.play2.ui.JVAlarmPlayActivity

com.jovision.play2.ui.JVRemoteLinePlayActivity

com.jovision.play2.devsettings.JVDevSettingsMainActivity

com.jovision.play2.devsettings.JVDevSettingsAlarmActivity

com.jovision.play2.devsettings.JVDevSettingsZoneActivity

com.jovision.play2.devsettings.JVDevSettingsSystemActivity

com.jovision.play2.devsettings.JVDevSettingsStorageActivity

com.jovision.play2.devsettings.JVDevSettingsVersionActivity

com.jovision.play2.devsettings.JVDevSettingsOthersActivity

com.jovision.play2.devsettings.JVDevSettingsAlarmTimeActivity

com.jovision.play2.devsettings.JVDevSettingsAlarmThirdActivity

com.jovision.play2.devsettings.JVDevSettingsZoneTimeActivity

com.jovision.play2.devsettings.JVDevSettingsZoneSetActivity

com.jovision.play2.devsettings.JVDevSettingsNickNameActivity

com.jovision.play2.devsettings.JVDevSettingsNewMainActivity

com.jovision.play2.devsettings.JVDevSettingsNewMain_SetTimeActivity

com.jovision.play2.devsettings.JVDevSettingsNewMain_OSDChangeActivity

com.jovision.play2.devsettings.JVDevSettingsNewMain_SetAlarmActivity

com.jovision.play2.devsettings.JVDevSettingsAlarmTimeNewActivity

com.jovision.play2.devsettings.JVDevSettingsZoneSetNewActivity

com.jovision.play2.devsettings.JVDevSettingsNewMain_AlarmAreaActivity

com.jovision.play2.devsettings.JVDevSettingsNewMain_AlarmSoundActivity

com.jovision.play2.devsettings.JVRecordingActivity

cn.udesk.activity.UdeskHelperActivity

cn.udesk.activity.UdeskHelperArticleActivity

cn.udesk.activity.UdeskRobotActivity

cn.udesk.activity.UdeskFormActivity

cn.udesk.activity.UdeskChatActivity

cn.udesk.activity.UdeskZoomImageActivty

cn.udesk.activity.UdeskSurvyDialogActivity

cn.udesk.activity.UdeskOptionsAgentGroupActivity

cn.udesk.activity.UdeskWebViewUrlAcivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

com.mob.tools.MobUIShell

android.intent.action.VIEW com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

com.jovetech.CloudSee.temp.wxapi.WXEntryActivity

com.check.ox.sdk.OxActivity

com.bytedance.sdk.openadsdk.activity.TTLandingPageActivity

com.bytedance.sdk.openadsdk.activity.TTVideoLandingPageActivity

com.bytedance.sdk.openadsdk.activity.TTRewardVideoActivity

com.bytedance.sdk.openadsdk.activity.TTFullScreenVideoActivity

com.bytedance.sdk.openadsdk.activity.TTDelegateActivity

com.ss.android.socialbase.appdownloader.view.DownloadSizeLimitActivity

com.ss.android.socialbase.appdownloader.view.DownloadTaskDeleteActivity

com.ss.android.downloadlib.activity.InteractionMiddleActivity

com.server.base.YdH5Activity

com.server.wxapi.WXEntryActivity

Android Permissions

6e7a2ce4e84d3902614490971e3cd58e_JaffaCakes118

Permissions

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.INTERNET

android.permission.CHANGE_CONFIGURATION

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.CHANGE_WIFI_STATE

android.permission.VIBRATE

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.READ_LOGS

android.permission.GET_TASKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CAMERA

android.permission.FLASHLIGHT

android.permission.WAKE_LOCK

android.permission.DISABLE_KEYGUARD

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.CALL_PHONE

android.permission.REORDER_TASKS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.SYSTEM_ALERT_WINDOW

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.CREATE_SHORTCUT

android.permission.GET_ACCOUNTS

android.permission.USE_CREDENTIALS

android.permission.MANAGE_ACCOUNTS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.WRITE_SYNC_SETTINGS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.WRITE_SETTINGS

android.permission.MANAGE_USERS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.FLAG_GRANT_READ_URI_PERMISSION

getui.permission.GetuiService.com.jovetech.CloudSee.temp

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.SYSTEM_OVERLAY_WINDOW