irata | گالری[.]apk

General

Target
گالری.apk
Size 8.2MB
Sample260810-ppsshatxay
SHA256 5dbf56c7eb444b3dc68d5b2afa65020c6f3599a71dc128a3a518a306267cc910
MD5 b1ae0b36fed08299868ea02469147e77
SHA1 d133876c284ad3bf3e9531c1f64a3d3a4442611a
SHA512 ff5e01bd8f56546c4ba2d709dbcd5cb09569a61315f4416e1b9b17f07a15bdc3c2e8cf5158658531fa8b5afbde0e8812db697948ffc467bd5e5708edc6be88a8
SSDEEP 196608:ARCWfAnRc418UJ4PSCeNHvlIYPgUNLUepLsJVdKUDC/:kBfwCe4bMvlLPBvV+VdKU2/
TLSH
T152863346FB971999C8E2833041B94B3932375C68D31B938B6374B2F62CB7ADC9B461D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat irata

Malware Config

Signatures

Family: Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
trojan infostealer rat irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata3

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
گالری.apk

File Explorer

گالری.apk

.apk 8.2MB

گالری.apk

SHA256 5dbf56c7eb444b3dc68d5b2afa65020c6f3599a71dc128a3a518a306267cc910
MD5 b1ae0b36fed08299868ea02469147e77
SHA1 d133876c284ad3bf3e9531c1f64a3d3a4442611a
SHA512 ff5e01bd8f56546c4ba2d709dbcd5cb09569a61315f4416e1b9b17f07a15bdc3c2e8cf5158658531fa8b5afbde0e8812db697948ffc467bd5e5708edc6be88a8
SSDEEP 196608:ARCWfAnRc418UJ4PSCeNHvlIYPgUNLUepLsJVdKUDC/:kBfwCe4bMvlLPBvV+VdKU2/
TLSH
T152863346FB971999C8E2833041B94B3932375C68D31B938B6374B2F62CB7ADC9B461D4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Irata payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

65ddfdb58f61b9cc519b234043ba046d895edd036323c8048cbc76944c5eae1d

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=dpt

com.elgfus.app

Android Permissions

گالری.apk

Permissions

com.elgfus.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.VIBRATE

android.permission.POST_NOTIFICATIONS

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

com.google.android.gms.permission.AD_ID

com.elgfus.app.permission.C2D_MESSAGE

android.permission.USE_BIOMETRIC

android.permission.USE_FINGERPRINT

com.google.android.providers.gsf.permission.READ_GSERVICES

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_CONTACTS

android.permission.RECEIVE_BOOT_COMPLETED

گالری.apk

File Signature issue

com.google.android.gms.common.api.GoogleApiActivity

.main

.main

.c1

.g1

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.sysc

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.newmessage

.firebasemessaging

.starter$starter_BR

.sysc$sysc_BR

.httputils2service

com.google.firebase.provider.FirebaseInitProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

گالری.apk

File Signature issue

com.google.android.gms.common.api.GoogleApiActivity

.main

.main

.c1

.g1

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

.starter

.sysc

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

.newmessage

.firebasemessaging

.starter$starter_BR

.sysc$sysc_BR

.httputils2service

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

گالری.apk