MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IRATA


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84
SHA3-384 hash: 90e26fa04a4e25df2f5f7fd29027c1c491472d2370ca00fd91a674642f470b2db527c1ec537754bd30e8e51132d202fc
SHA1 hash: 1a1c24247f8c5cc8f0e08d3d72ac89282e7950f2
MD5 hash: 46d1f449540173f51003717513ef5ed4
humanhash: harry-autumn-paris-jig
File name:saham.apk
Download: download sample
Signature IRATA
Create hunting rule
File size:2'826'335 bytes
First seen:2023-10-03 08:55:43 UTC
Last seen:2025-03-24 04:26:10 UTC
File type: apk
MIME type:application/zip
ssdeep 49152:9/jsWXkkbeXfQLR7+2L9Jw7be6SffTeFe2oEkVCBqQyD9S9Mg0gmQIEmrggF1BCn:VBXkk6XfIR7TL9m7K6aek2oElyDz1ggY
TLSH T195D52283F269A45BC8F1C37225A42A3511774D1ADB43B74A391C73BE2FBBDE80B85194
TrID 40.1% (.APK) Android Package (32500/1/6)
37.0% (.SPE) SPSS Extension (30000/1/7)
16.6% (.JAR) Java Archive (13500/1/2)
4.9% (.ZIP) ZIP compressed archive (4000/1)
1.2% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter onecert_ir
Tags:android apk IRATA signed

Code Signing Certificate

Organisation:Android
Issuer:Android
Algorithm:sha1WithRSAEncryption
Valid from:2008-02-29T01:33:46Z
Valid to:2035-07-17T01:33:46Z
Serial number: 936eacbe07f201df
Intelligence: 1757 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
onecert_ir
IRATA

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Android.Spy.Lydia.6.23953.17155.UNOFFICIAL
Create hunting rule

Gathering data
Result
Link:
https://incinerator.cloud/#/public/report/46d1f449540173f51003717513ef5ed4/detail
Application Permissions
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84
Result
Threat name:
Irata
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1318558
Signature
Antivirus / Scanner detection for submitted sample
Detected Irata
Drops a new APK file
Multi AV Scanner detection for submitted file
Tries to detect Android x86
Tries to detect the analysis device (e.g. the Android emulator)
Yara detected IRATA
Behaviour
Behavior Graph:
n/a
Detection:
lydia
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-10-03 08:56:06 UTC
File Type:
Binary (Archive)
Extracted files:
147
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpwvqzfx6zn3vxhtacrmunr7ibq74w366deuc3rutxphahgphkca._file
Result
Malware family:
irata
Create hunting rule
Score:
  10/10
Tags:
family:irata android
Link:
https://tria.ge/reports/231003-kv1m3she7v/
Behaviour
Reads information about phone network operator.
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IRATA

apk 2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84

(this sample)

  
Dropping
IRATA
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2716061/

Comments