Overview

overview

10

Static

static

6

7f1c986ae3...e2.apk

android-9-x86

10

7f1c986ae3...e2.apk

android-10-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    32d0da5518c5d801671cb592e94bd48b.bin
  • Size 57.9MB
  • Sample240108-bj35dshebk
  • SHA256 c31cc01d1ce729cc4b311217602e599f516998170067510a25ffe771d66d7634
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
badbazaarandroidinfostealerspywaretrojan

Malware Config

Targets

    • Target
      7f1c986ae33571b0bfaae617d9e4bb02bd2c5e5dab71a24ba6c68d650148fee2.apk
    • Size 62.6MB
    • SHA256 7f1c986ae33571b0bfaae617d9e4bb02bd2c5e5dab71a24ba6c68d650148fee2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    badbazaarinfostealerspywaretrojan

    • BadBazaar

      BadBazaar is an Android spyware used by GREF APT group.

      spywareinfostealertrojanbadbazaar

    • BadBazaar payload

    • Checks Android system properties for emulator presence.

    • Checks known Qemu files.

      Checks for known Qemu files that exist on Android virtual device images.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks