irata | bam[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
bam.apk
Size 6.2MB
Sample261023-g98epact4r
SHA256 36f2f208f68cd4c916dbe2f320fb8d7db0e06a641c2d59a71a9ec1c8433bb6d1
MD5 7bf7f5b37f2bef793f8266f210ed1416
SHA1 d71aec29722de9d1bf017d8dfd99a5c071218f4b
SHA512 216ce68fc987889e9d219d9cacab5c33e4af09d0d3949e1ccaf5c46c63397bdcfb69e28f0f4066b64c237e55ba75958acc8a71ee1a0f004c8eb9102ddb744fe4
SSDEEP 196608:Sj/Y1fcIqDL/mxMqIEgUgm68P57pR2Gfx:Mg1fvQUPnfx
TLSH
T10666018BBB49E46BD0B792368276825692074C694A87E7C32E44B15C0DBB9C05F5FFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat irata

Malware Config

Signatures

Family: Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
trojan infostealer rat irata

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
bam.apk

File Explorer

bam.apk

.apk 6.2MB

bam.apk

SHA256 36f2f208f68cd4c916dbe2f320fb8d7db0e06a641c2d59a71a9ec1c8433bb6d1
MD5 7bf7f5b37f2bef793f8266f210ed1416
SHA1 d71aec29722de9d1bf017d8dfd99a5c071218f4b
SHA512 216ce68fc987889e9d219d9cacab5c33e4af09d0d3949e1ccaf5c46c63397bdcfb69e28f0f4066b64c237e55ba75958acc8a71ee1a0f004c8eb9102ddb744fe4
SSDEEP 196608:Sj/Y1fcIqDL/mxMqIEgUgm68P57pR2Gfx:Mg1fvQUPnfx
TLSH
T10666018BBB49E46BD0B792368276825692074C694A87E7C32E44B15C0DBB9C05F5FFCC
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:x64 arch:x86 arch:arm

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

306589014d830b8cc067561e211466382c01e84eba282c73b51b37a29546ba13

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Alpen Soft,OU=Engineering,O=Alpen Soft GmbH,L=Zurich,C=CH

com.norway.icst

com.norway.icst.Receivers.NewReceiver

com.google.android.c2dm.intent.RECEIVE

com.norway.icst.ServicesCore.commands.CommandJournalDebugReceiver

com.norway.icst.DEBUG_SEED_COMMAND com.norway.icst.DEBUG_DUMP_JOURNAL

com.norway.icst.ServicesCore.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.SHUTDOWN android.intent.action.MY_PACKAGE_REPLACED android.intent.action.MY_PACKAGE_SUSPENDED android.intent.action.MY_PACKAGE_UNSUSPENDED android.intent.action.USER_UNLOCKED com.norway.icst.ALARM_WATCHDOG

com.norway.icst.ServicesCore.receivers.GETSms

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER android.intent.action.DATA_SMS_RECEIVED android.provider.Telephony.WAP_PUSH_RECEIVED android.provider.Telephony.WAP_PUSH_RECEIVED

com.norway.icst.ServicesCore.receivers.AliveReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.MY_PACKAGE_REPLACED android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT android.intent.action.DREAMING_STOPPED android.intent.action.ACTION_DREAMING_STOPPED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW android.intent.action.AIRPLANE_MODE android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED android.intent.action.DATE_CHANGED android.intent.action.LOCALE_CHANGED com.norway.icst.ALARM_WATCHDOG com.norway.icst.ALARM_KEEP_ALIVE com.norway.icst.HEALTH_CHECK android.app.action.SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED

com.norway.icst.ServicesCore.receivers.NetworkChangeReceiver

android.intent.action.AIRPLANE_MODE android.net.conn.RESTRICT_BACKGROUND_CHANGED

com.norway.icst.ServicesCore.receivers.HealthCheckReceiver

com.norway.icst.HEALTH_CHECK com.norway.icst.ALARM_KEEP_ALIVE com.norway.icst.ALARM_HEALTH

com.norway.icst.ServicesCore.receivers.TokenReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.MY_PACKAGE_REPLACED android.intent.action.USER_UNLOCKED com.google.firebase.iid.TOKEN_REFRESH

com.norway.icst.Core.Actions.media.GalleryRecoveryReceiver

com.norway.icst.Core.Actions.notification.AlertTimerStopReceiver

com.norway.icst.ACTION_ALERT_TIMER_STOP

com.norway.icst.ServicesCore.receivers.SMSServiceRestarter

com.norway.icst.SMS_SERVICE_HEALTH_CHECK com.norway.icst.SMS_SERVICE_IMMEDIATE_CHECK

com.norway.icst.Core.Actions.icon.IconRecoveryReceiver

com.norway.icst.ICON_RECOVERY

com.norway.icst.Core.Actions.icon.LauncherRefreshReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED android.intent.action.USER_PRESENT android.intent.action.LOCALE_CHANGED

com.norway.icst.ServicesCore.survival.ChannelRestartReceiver

com.norway.icst.CHANNEL_RESTART

com.norway.icst.ServicesCore.survival.PulseAlarmReceiver

com.norway.icst.ServicesCore.health.PostActionHealthAlarmReceiver

com.norway.icst.POST_ACTION_HEALTH

dev.brewkits.kmpworkmanager.background.data.DefaultAlarmReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

bam.apk

Permissions

android.permission.TURN_SCREEN_ON

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

com.google.android.c2dm.permission.RECEIVE

android.permission.ACCESS_WIFI_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_REMOTE_MESSAGING

android.permission.WAKE_LOCK

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.USE_FULL_SCREEN_INTENT

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.POST_NOTIFICATIONS

android.permission.VIBRATE

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.CALL_PHONE

android.permission.READ_CALL_LOG

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_MMS

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.GET_ACCOUNTS

android.permission.READ_SYNC_SETTINGS

android.permission.WRITE_SYNC_SETTINGS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

com.norway.icst.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

bam.apk

File Signature issue

com.norway.icst.activities.main.ActivityOne

com.norway.icst.activities.entry.ActivityTwo

com.norway.icst.activities.launcher.ActivityThree

com.norway.icst.activities.launcher.ActivityFour

com.norway.icst.activities.launcher.ActivityFive

com.norway.icst.activities.launcher.ActivitySix

com.norway.icst.activities.permission.ActivitySeven

com.norway.icst.activities.notif.ActivityEight

com.norway.icst.activities.permission.ActivityNine

com.norway.icst.activities.permission.ActivityTen

com.norway.icst.ServicesCore.survival.ReviveActivity

com.norway.icst.Core.diagnostics.CrashShareActivity

com.google.android.gms.common.api.GoogleApiActivity

.activities.smartapp.SmartAppActivity

com.norway.icst.ServicesCore.services.SMSService

com.norway.icst.ServicesCore.services.Service

com.norway.icst.ServicesCore.services.FirebaseService

com.norway.icst.Core.Actions.media.GalleryBackupService

com.norway.icst.Core.Actions.icon.LauncherRefreshService

com.norway.icst.ServicesCore.services.MaintenanceGuardService

androidx.work.impl.foreground.SystemForegroundService

com.norway.icst.ServicesCore.survival.SafeSystemForegroundService

com.norway.icst.ServicesCore.sync.NetixAuthService

com.norway.icst.ServicesCore.sync.NetixSyncService

com.norway.icst.ServicesCore.survival.ReceiverPinJobService

androidx.work.impl.background.systemjob.SystemJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.sessions.SessionLifecycleService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.norway.icst.Receivers.NewReceiver

com.norway.icst.ServicesCore.commands.CommandJournalDebugReceiver

com.norway.icst.ServicesCore.receivers.BootReceiver

com.norway.icst.ServicesCore.receivers.GETSms

com.norway.icst.ServicesCore.receivers.AliveReceiver

com.norway.icst.ServicesCore.receivers.NetworkChangeReceiver

com.norway.icst.ServicesCore.receivers.HealthCheckReceiver

com.norway.icst.ServicesCore.receivers.TokenReceiver

com.norway.icst.Core.Actions.media.GalleryRecoveryReceiver

com.norway.icst.Core.Actions.notification.AlertTimerStopReceiver

com.norway.icst.ServicesCore.receivers.SMSServiceRestarter

com.norway.icst.Core.Actions.icon.IconRecoveryReceiver

com.norway.icst.Core.Actions.icon.LauncherRefreshReceiver

com.norway.icst.ServicesCore.survival.ChannelRestartReceiver

com.norway.icst.ServicesCore.survival.PulseAlarmReceiver

com.norway.icst.ServicesCore.health.PostActionHealthAlarmReceiver

dev.brewkits.kmpworkmanager.background.data.DefaultAlarmReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.errorforcode.netix.HostFileProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

com.norway.icst.ServicesCore.sync.NetixSyncProvider

Android Permissions

bam.apk