irata | 6b4d201bfe3ec7b7e235d5218d88d98618fc5535961342f0a9c3d7cb529ef4fb | Triage

Sharing

General

Target

6b4d201bfe3ec7b7e235d5218d88d98618fc5535961342f0a9c3d7cb529ef4fb
Size

1.9MB
Sample

240524-ry17cahd6s
MD5

6dd64369b6847899ce283cd0ae6bdd60
SHA1

67324744f73392903a0f89dda8e4d81741d32f53
SHA256

6b4d201bfe3ec7b7e235d5218d88d98618fc5535961342f0a9c3d7cb529ef4fb
SHA512

322e22b3da8c98f92c7eabf3815c3f8da551541f3a28e623b13c1c686d28d5e46057bffad33c07a5eccb40038771dfcfe02872380b4df74a7c8d2f3e9602f724
SSDEEP

49152:LwuyKaz4XDNj1Gd5gln6l0jY7+IwvXEE+yD:YKaz4d1O+pjY7+pEUD

Score

10^/10

irata android collection credential_access discovery evasion impact persistence

Malware Config

Targets

- Target
  
  6b4d201bfe3ec7b7e235d5218d88d98618fc5535961342f0a9c3d7cb529ef4fb
- Size
  
  1.9MB
- MD5
  
  6dd64369b6847899ce283cd0ae6bdd60
- SHA1
  
  67324744f73392903a0f89dda8e4d81741d32f53
- SHA256
  
  6b4d201bfe3ec7b7e235d5218d88d98618fc5535961342f0a9c3d7cb529ef4fb
- SHA512
  
  322e22b3da8c98f92c7eabf3815c3f8da551541f3a28e623b13c1c686d28d5e46057bffad33c07a5eccb40038771dfcfe02872380b4df74a7c8d2f3e9602f724
- SSDEEP
  
  49152:LwuyKaz4XDNj1Gd5gln6l0jY7+IwvXEE+yD:YKaz4d1O+pjY7+pEUD
Score

7^/10

discovery evasion persistence collection credential_access impact
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

collectioncredential_accessdiscoveryevasionimpactpersistence

behavioral3

collectioncredential_accessdiscoveryevasionimpact