irata | b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790[.]zip

General

Target
b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.zip
Size 7.4MB
Sample260728-v8pg3ssyht
SHA256 3f137b2de6947fc559981bbf137c6875711471a372a86152e097a940a91e644a
MD5 edc147a717fac8a5f714a50de7172f15
SHA1 4a10815bfc894dbb22dedb514f627cdedcad6e84
SHA512 d7b88ae0c1a99f077121641341606f73975d528e9f93903918c3e2097c481680fcef014767602197a28fadaa246b4623fed5ae939962e015b851b61f809ce507
SSDEEP 196608:esA7xFfudZMi5nhKEz5L/P9vuzIe+E/3tWOP4:K7Oz5rz5L/Pa+E/0OP4
TLSH
T1E17633DE4F42EF4B7EEB18E6F5342C9305AEB0C2591024F42C46D51692CAFCAE671B58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat irata

Malware Config

Signatures

Family: Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
trojan infostealer rat irata

Irata payload 1 IoCs

resource	yara_rule
static1/unpack001/b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk	family_irata3

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk

File Explorer

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.zip

.zip 7.4MB
b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk

.apk 7.7MB

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.zip

SHA256 3f137b2de6947fc559981bbf137c6875711471a372a86152e097a940a91e644a
MD5 edc147a717fac8a5f714a50de7172f15
SHA1 4a10815bfc894dbb22dedb514f627cdedcad6e84
SHA512 d7b88ae0c1a99f077121641341606f73975d528e9f93903918c3e2097c481680fcef014767602197a28fadaa246b4623fed5ae939962e015b851b61f809ce507
SSDEEP 196608:esA7xFfudZMi5nhKEz5L/P9vuzIe+E/3tWOP4:K7Oz5rz5L/Pa+E/0OP4
TLSH
T1E17633DE4F42EF4B7EEB18E6F5342C9305AEB0C2591024F42C46D51692CAFCAE671B58
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk

SHA256 b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790
MD5 3cded602dc6eeae332cfb4efc766f981
SHA1 c3189ad45becfc7f80bc0d3b7271b3a39c21e5a6
SHA512 56f23eff64367d2c238118e88cb2a3aadba3822e7b148b516ccbb4a041d7b09e58ec180eb111b492a0deffedf0c3763cb0ab30b94234141a4ddde59336615779
SSDEEP 196608:+C8KA9chuzXZOoIOtT79UwruqBtEKwISLCjTUnUSV8+/j:+nKAlzooIylmkEmTUnU4n7
TLSH
T16E863302FB927DAAC4E6D33011B9172660364F55930BA78B6370B7F928B7BD85B431C6
MD5 SHA1 SHA512 SSDEEP TLSH

android

Irata payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

File Signature issue

Digest

c10e314f5ddb7a574450ac4fa38e0fa36e089214feb95c4a98cd48859150963b

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=dpt

com.elgfus.app

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.zip

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk

File Signature issue

com.google.android.gms.common.api.GoogleApiActivity

.main

.main

.c1

.g1

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.sysc

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.newmessage

.firebasemessaging

.starter$starter_BR

.sysc$sysc_BR

.httputils2service

com.google.firebase.provider.FirebaseInitProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.zip

b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790.apk

File Signature issue

com.google.android.gms.common.api.GoogleApiActivity

.main

.main

.c1

.g1

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.sysc

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.newmessage

.firebasemessaging

.starter$starter_BR

.sysc$sysc_BR

.httputils2service

com.google.firebase.provider.FirebaseInitProvider