irata | jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1[.]bin

General

Target
jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin
Size 9.2MB
Sample260922-lwl2ratarc
SHA256 0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1
MD5 f94ad2a34c38d1672d190f02e7f29158
SHA1 095d3efefd2bf21ba5bab050ae962f6c23cc0196
SHA512 642f87eacd6174ffda5083b9fe4cac1372f7b6278a1b1c63a57679a3859a3aecd69af9cb93336db53c173d1aa8e8fd59487cef69d290682e637963927b0bb92b
SSDEEP 196608:cfwLF//gEuUFXno/HwLF//gEuUFXno/QCqgjf3:cG/4Wno/HG/4Wno/Q2jv
TLSH
T176A62371A7E1832BFAB767B0FA33D982156BFC84A42C91487205E07765B7E8853487F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat irata

Malware Config

Signatures

Family: Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
trojan infostealer rat irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata2

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

File Explorer

jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

.apk 9.2MB

jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

SHA256 0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1
MD5 f94ad2a34c38d1672d190f02e7f29158
SHA1 095d3efefd2bf21ba5bab050ae962f6c23cc0196
SHA512 642f87eacd6174ffda5083b9fe4cac1372f7b6278a1b1c63a57679a3859a3aecd69af9cb93336db53c173d1aa8e8fd59487cef69d290682e637963927b0bb92b
SSDEEP 196608:cfwLF//gEuUFXno/HwLF//gEuUFXno/QCqgjf3:cG/4Wno/HG/4Wno/Q2jv
TLSH
T176A62371A7E1832BFAB767B0FA33D982156BFC84A42C91487205E07765B7E8853487F1
MD5 SHA1 SHA512 SSDEEP TLSH

android

Irata payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9adc024c42fff835775f8a7ebdadaf7fff9953b3

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Anywhere Software,O=Anywhere Software,C=US

Chains

Jan 1, 0001

b4a.example

Android Permissions

jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

Permissions

android.permission.INTERNET

android.permission.VIBRATE

android.permission.READ_SMS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

b4a.example.permission.C2D_MESSAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin

File Signature issue

com.google.android.gms.common.api.GoogleApiActivity

com.google.android.gms.common.api.GoogleApiActivity

.main

.intent

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.crash.internal.service.FirebaseCrashReceiverService

com.google.firebase.crash.internal.service.FirebaseCrashSenderService

.starter

.firebasemessaging

.net

.receiver

.httputils2service

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

.starter$starter_BR

.firebasemessaging$firebasemessaging_BR

.net$net_BR

.receiver$receiver_BR

.httputils2service$httputils2service_BR

com.google.firebase.provider.FirebaseInitProvider

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

jaffacakes118_0f40026a52eb484ac25aced80e829cee681f89ec2543be9ce4f413c43570d6a1.bin