irata | 5ac0516a1c4876afaef78a9463a5311e250f780563924ce36518621906ac9451 | Triage

Sharing

General

Target

5ac0516a1c4876afaef78a9463a5311e250f780563924ce36518621906ac9451.bin
Size

4.5MB
Sample

250104-1yfp3szkct
MD5

7de05fc6e00db0fe4b5054fc55be0c2e
SHA1

8f3c46b091e54c1aaba0dacdd2133b655b4a804f
SHA256

5ac0516a1c4876afaef78a9463a5311e250f780563924ce36518621906ac9451
SHA512

2d36d4353992a4350c9c0e44e0da19e19ea244f33aa6dd5504904d7151bed316a9c82b8e6a2a9c53ca080b06486b02d816476ecbe0c196893c7ab5095b0345b4
SSDEEP

98304:XMTwrB/orDVlA4MSYGnOohCLLowWdBnyL+lyxgId3:9orD3dqTWXlyxv3

Score

10^/10

irata android banker collection credential_access discovery evasion impact persistence

Malware Config

Targets

- Target
  
  5ac0516a1c4876afaef78a9463a5311e250f780563924ce36518621906ac9451.bin
- Size
  
  4.5MB
- MD5
  
  7de05fc6e00db0fe4b5054fc55be0c2e
- SHA1
  
  8f3c46b091e54c1aaba0dacdd2133b655b4a804f
- SHA256
  
  5ac0516a1c4876afaef78a9463a5311e250f780563924ce36518621906ac9451
- SHA512
  
  2d36d4353992a4350c9c0e44e0da19e19ea244f33aa6dd5504904d7151bed316a9c82b8e6a2a9c53ca080b06486b02d816476ecbe0c196893c7ab5095b0345b4
- SSDEEP
  
  98304:XMTwrB/orDVlA4MSYGnOohCLLowWdBnyL+lyxgId3:9orD3dqTWXlyxv3
Score

8^/10

banker discovery evasion impact persistence collection credential_access
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

behavioral1

bankerdiscoveryevasionimpactpersistence

behavioral2

bankercollectioncredential_accessdiscoveryevasionimpact