irata | ffd29c57df2fb49013dfad0cf4182921e6ec36df41d69a4cb7838b09a4ba779b

General

Target
ffd29c57df2fb49013dfad0cf4182921e6ec36df41d69a4cb7838b09a4ba779b.apk
Size 3.3MB
Sample260819-dydjdscg45
SHA256 ffd29c57df2fb49013dfad0cf4182921e6ec36df41d69a4cb7838b09a4ba779b
MD5 d716e8164fa29e5ade634235aeaca7d9
SHA1 580643a4e4bee2114ffdd18396c134c619285522
SHA512 18a7545c5311e7577e82070a8dd6d1b787abb05c16324900de5bacafd814394b86cbfe76414da7bf4cac09a74072f0e7b9c2ee9700b88fde8e8500ea86f83384
SSDEEP 98304:4EVF6aL7fDW3v0AMYfccAKmg/+Vv2+c9vhG1uP6J6tSiu+iX:446x3vKcAxgGVXc9JPZ+3X
TLSH
T13FF5330BFFD3E530D617B03980E4629EF975A115561CFF03AA44A68909F2D86FB07E62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

irata android antivm c2 defense_evasion discovery evasion exfiltration infostealer masquerading otp persistence rat sms stealer suspicious trojan

Malware Config

Extracted

Family

irata

C2

https://edaltiir.ml

Targets

- Target
  ffd29c57df2fb49013dfad0cf4182921e6ec36df41d69a4cb7838b09a4ba779b.apk
- Size 3.3MB
- SHA256 ffd29c57df2fb49013dfad0cf4182921e6ec36df41d69a4cb7838b09a4ba779b
- MD5 d716e8164fa29e5ade634235aeaca7d9
- SHA1 580643a4e4bee2114ffdd18396c134c619285522
- SHA512 18a7545c5311e7577e82070a8dd6d1b787abb05c16324900de5bacafd814394b86cbfe76414da7bf4cac09a74072f0e7b9c2ee9700b88fde8e8500ea86f83384
- SSDEEP 98304:4EVF6aL7fDW3v0AMYfccAKmg/+Vv2+c9vhG1uP6J6tSiu+iX:446x3vKcAxgGVXc9JPZ+3X
- TLSH
  T13FF5330BFFD3E530D617B03980E4629EF975A115561CFF03AA44A68909F2D86FB07E62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery defense_evasion persistence
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Reads information about phone network operator.

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3