irata | 2d5e80f752608faa23f05e6558a695fcac261d78b9979d6746dc11dc995665e3

General

Target

2d5e80f752608faa23f05e6558a695fcac261d78b9979d6746dc11dc995665e3.bin
Size

4.6MB
Sample

240531-3mhreaae22
MD5

3c90ca08d834d4650409a4282bbe6d42
SHA1

8698e712dc3ae9b2554f421d14e2d77323f0896a
SHA256

2d5e80f752608faa23f05e6558a695fcac261d78b9979d6746dc11dc995665e3
SHA512

085531b43425bd5e234bbd7f50c21a2c3f7a76870cf5bc91b8f74f90d05f76556bbc742fefd02ffbe76180c6f290c4afd595efed128af41da1356ec33eb91468
SSDEEP

98304:w/lGJUYCfFbE1ybv0J6zhED0e9D0hD0cD0ErD0nAHD0PD08D0w7R:wgvmFbz0J6zhEDjDYDpDBDCiDWDlDT7R

Score

10^/10

Malware Config

Targets

- Target
  
  2d5e80f752608faa23f05e6558a695fcac261d78b9979d6746dc11dc995665e3.bin
- Size
  
  4.6MB
- MD5
  
  3c90ca08d834d4650409a4282bbe6d42
- SHA1
  
  8698e712dc3ae9b2554f421d14e2d77323f0896a
- SHA256
  
  2d5e80f752608faa23f05e6558a695fcac261d78b9979d6746dc11dc995665e3
- SHA512
  
  085531b43425bd5e234bbd7f50c21a2c3f7a76870cf5bc91b8f74f90d05f76556bbc742fefd02ffbe76180c6f290c4afd595efed128af41da1356ec33eb91468
- SSDEEP
  
  98304:w/lGJUYCfFbE1ybv0J6zhED0e9D0hD0cD0ErD0nAHD0PD08D0w7R:wgvmFbz0J6zhEDjDYDpDBDCiDWDlDT7R
Score

8^/10

collection credential_access discovery evasion persistence impact
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3