badbazaar | c31cc01d1ce729cc4b311217602e599f516998170067510a25ffe771d66d7634

Analysis

max time kernel
3869520s
max time network
152s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
08/01/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f1c986ae33571b0bfaae617d9e4bb02bd2c5e5dab71a24ba6c68d650148fee2.apk
Size 62.6MB
Sample240108-bj35dshebk
SHA256 7f1c986ae33571b0bfaae617d9e4bb02bd2c5e5dab71a24ba6c68d650148fee2
MD5 32d0da5518c5d801671cb592e94bd48b
SHA1 5df6c83721f188f5baf7f878d3e8d41ccd1e64a6
SHA512 811e4bf5d453fc86fa3708c58b075aa7dc81864f326ebad65d30d00d7499c4fde953c5271c7dcdc70c4ee232d34de954ef1f648d97ea71aae99e803ee15f902c
SSDEEP 1572864:xaiDh7S59M9UdpTDiMYUR4ACYEAtftncrWOLoHJVSv:xail9kpHoUR4ACNelnOWIopVSv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badbazaar infostealer spyware trojan

Malware Config

Signatures

BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
spyware infostealer trojan badbazaar

BadBazaar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4988-2.dex	family_badbazaar

Checks Android system properties for emulator presence. 5 IoCs

description	ioc	Process
Accessed system property	key: ro.bootloader	cn.telegram.messenger
Accessed system property	key: ro.bootmode	cn.telegram.messenger
Accessed system property	key: ro.hardware	cn.telegram.messenger
Accessed system property	key: ro.product.device	cn.telegram.messenger
Accessed system property	key: ro.product.name	cn.telegram.messenger

Checks known Qemu files. 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

ioc	Process
/sys/qemu_trace	cn.telegram.messenger
/system/bin/qemu-props	cn.telegram.messenger
/system/lib/libc_malloc_debug_qemu.so	cn.telegram.messenger

Checks known Qemu pipes. 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

ioc	Process
/dev/socket/qemud	cn.telegram.messenger
/dev/qemu_pipe	cn.telegram.messenger

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/product/framework/com.google.android.maps.jar	4988	cn.telegram.messenger
/product/framework/com.google.android.maps.jar	4988	cn.telegram.messenger
/data/data/cn.telegram.messenger/.jiagu/classes.dex	4988	cn.telegram.messenger
/data/data/cn.telegram.messenger/.jiagu/classes.dex!classes2.dex	4988	cn.telegram.messenger
/data/data/cn.telegram.messenger/.jiagu/classes.dex!classes3.dex	4988	cn.telegram.messenger

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cn.telegram.messenger

cn.telegram.messenger
1⤵
- Checks Android system properties for emulator presence.
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/cn.telegram.messenger/.jiagu/classes.dex
Size 9.1MB
SHA256 ce1a42b1b6f8f5dad8b2565b88ded0a24ec9b552ff3b22f3dfbdbc5c7f3f6e6b
MD5 92a89ef68b6b0cddcaedc247bc94b4a4
SHA1 32e8422c4d64665a584f0844ddab2b6f662b867d
SHA512 5539896e7e563873c65d958e2b0c8970afaa7d31c12b340a96d2d867e2ab4409b3521a9a133a23d4607da458b21433bdfe0169d337f55fa1186a5a483a4d7f5f
SSDEEP 98304:l6Pv9nsJdSH9PtoH++aV8yRnQE1Pa1IKA0AsNTmkm/X:odnskh1P8mv
MD5 SHA1 SHA512 SSDEEP

Download

classes.dex!classes2.dex

Path /data/data/cn.telegram.messenger/.jiagu/classes.dex!classes2.dex
Size 8.4MB
SHA256 c78015831fff866a39a850936f91ec57c20b63a09be869da34f79c7af0a7e019
MD5 5a8d8d739fc9b687d38cec2c5482740e
SHA1 f5e27655cd83a785bc44895404cd9513a75d925d
SHA512 88555711a824d5e3c9c0ae545e41d7c67088f7a33eb66635e3f3cc3b282323a41eec25ca471d867ab25e30bbf258c7d3bb2796c5ebc861893dd1b23abc80493b
SSDEEP 98304:QveeK4Jsfpy9hIqU7IxnlDh++jOt3zOF7XJJIpnPQbocnRJzu7v0:qeeK4JKMjOtDiXJJIpnPQUcKz0
MD5 SHA1 SHA512 SSDEEP

Download

classes.dex!classes3.dex

Path /data/data/cn.telegram.messenger/.jiagu/classes.dex!classes3.dex
Size 110KB
SHA256 47a15a504fcce9408f6b504ec5b3901b1289a3c27a14e39cd2492a8bb2dbdc1b
MD5 41b0a401daadbb40d99545367fa68e41
SHA1 31d9e01f3fefd92ce29bd7384b83c8f5b7a670e9
SHA512 7a83291e9d1d4706c7d68bb43e33d913ffafd8eee9d4fe48dc0e4aa22c10d977c8732f351ae19cffb182e9a2810d75283cbb3d3e02ae5c22e22a7ff9bce21b08
SSDEEP 1536:+vtku4NZ9vpTSMx2bTM5zhkVx4CdrmwTKyaUV2z410RW2z/+xgnrfkdcXhB33:+vtr4LBpTSMx2c5zhetT55xgz7vn
MD5 SHA1 SHA512 SSDEEP

Download

libjiagu.so

Path /data/data/cn.telegram.messenger/.jiagu/libjiagu.so
Size 675KB
SHA256 9570f8631f57b4968637442ceafe395b7df3ea34724dc3fb41ca7d23e7ebdc2a
MD5 2b5629db65771c510889b41013163884
SHA1 89d58a00120096b1045c7010cbefe83225c8ab66
SHA512 3c29b91142ddc78ee26a9a19e85bfa144a27e6b618a611fda67143142909117e6122cb46f1de2995e07e63e6e09f72224f9f04c77dc81e81d9a8b92c580b4eee
SSDEEP 12288:p1j6x7z5XjIm7UY3BDngNHCiLrjEnKCz9+J72a3RF5B/TlxfgPC5fCZt8e:TGx7z5XjIm7UYqtBX8KCx8LhF5mq5fw
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu_64.so

Path /data/data/cn.telegram.messenger/.jiagu/libjiagu_64.so
Size 790KB
SHA256 3079baec19e6facec00533ebeabb16798e4c8567726e5a3b9cbde1c8548fbf41
MD5 2566fb47f0d5b347cd2132b545cf74c0
SHA1 1bbb212951ff1f47a71724bcb0923c987d04a00a
SHA512 77babf2491e15fb60c12bdfa4e195fb4842ac3be4ac308c94618df162f0efb6cd274b5331f85b3e639e1d1f1909dc4eb9b1a4c3e99157e2c42238834101ad7f8
SSDEEP 24576:PtQUqoyommvPkUhZhuV43KB05wIh1nQL1oRegYNe6WtxHU/Yallusc8pSu4:Pttn/0gYk6yHU/Ycgsc8Y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

.fsgkea

Path /data/data/cn.telegram.messenger/.oabugaij/.fsgkea
Size 1B
SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
MD5 01abfc750a0c942167651c40d088531d
SHA1 d08f88df745fa7950b104e4a707a31cfce7b5841
SHA512 d369286ac86b60fa920f6464d26becacd9f4c8bd885b783407cdcaa74fafd45a8b56b364b63f6256c3ceef26278a1c7799d4243a8149b5ede5ce1d890b5c7236
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/cn.telegram.messenger/app_crashrecord/1004
Size 230B
SHA256 1a53ea2f1129a0ff41015ccf5d077f4c5d7a690ffbbf80e19364141be966d465
MD5 cb632628b6492da3b07afb1c6a95bcda
SHA1 6e3e9f395d17eb0ff2cd07e56118ffac7ec944a5
SHA512 a65bd9b106f9ca201a8d8323fa8042780dcffdc679d80b8a008f006cba6b57ad8254db5bd609ff318580f365f24988968bad1002fddb56898ac0e5ae0b99a76d
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/cn.telegram.messenger/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/cn.telegram.messenger/databases/bugly_db_
Size 60KB
SHA256 1c7722f2b521f77f6ff181538238957da492bcd849319e7dfd2572f8dd37e43d
MD5 251a9767c0e1aa0d36dc69d6cba3c74d
SHA1 82d674404cf7abef9bcf67024d029f5d8c61d13b
SHA512 68c6dfc58a05e8c29ffe4a7a49d77cabaa8a4be159245c81bb993df5909e63ba4c8a307978d1e014418c0267cd2e384b462650b650109d4178f71113676f3933
SSDEEP 24:TLr9q5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGS66GICnpQLCi0iZV+zC:Tg5EpAuAriStwwuMN5meposScQLCit+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/cn.telegram.messenger/databases/bugly_db_-journal
Size 512B
SHA256 db7d1f263db93c2b24e8c71413efaa89fb5d47512890fd4c02b6d9bd3bbc7d49
MD5 7fed0592b5f51823a914dce71074c6d9
SHA1 b1c545f96a1b269352ec068c918444f27a3c38d6
SHA512 c11cce6d0ab0a92dded44032ab89a43890f9454e956fb65efb11f8e0d6a473b82f9e978adc44ab4bd2ac6e1ca4af2a265556cade32f6db5d8cb26d6fc010e2f4
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/cn.telegram.messenger/databases/bugly_db_-journal
Size 8KB
SHA256 6cd2bcae08f24a6103536cc4b212cf7be7349d0e6a5fc90fe57d068b4b0b4bd3
MD5 9fa2878f00330c5d7ac51ab7f8ee4f94
SHA1 f820cb0ba6af22fa16ef4fdd7da1365b94af3db8
SHA512 43e8b24942fe0a0dbb4d44d73e7d66a9b1fd1bd26db26fb8673dcf1a2c0c8ee114777468c94b4cc0202fa9c6584ddccaa56e33796acb936e4786c68d6ceb4ec1
SSDEEP 6:7+/l9Mn1bg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKJu:7+tkqLiuWdwRmBEyPbgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/cn.telegram.messenger/databases/bugly_db_-journal
Size 8KB
SHA256 4595039f3a4e6bf213e6d670b738d4a162c9e8aa5e4358bb5f54b6af61a2b827
MD5 6ba59bba2f67cd7cafa4a3bb1a49dda3
SHA1 9924b564fe7698fc0c64681d7d4e7bdf16b5cc07
SHA512 9c703eaa2c5b4117f86085140b11f5272475cac6db625de43a108a84fd3e970151fbb61a93b044f93a71a65cf3fc1e943d434ee3d66d550eac691560bc4a5885
SSDEEP 6:7+/l9+FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyet/h:7+tgBqLJdTRmBEyPbDah
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/cn.telegram.messenger/databases/bugly_db_-journal
Size 8KB
SHA256 e4cd287d7fad0ab5c4df36945f72f51bbdb378f605d33219cbe55f51903e7ced
MD5 8c874aaaa2f811296a9b5b40e6096938
SHA1 80c2960e751d1e97aa49aba83012e9a9839851c7
SHA512 0ecf0ae79400228f30cf34661be1bbcce6f6c082ac230c78c35127d67592d5dee5f05557b6ca04baba6fe5a6c9d1f6dff949d4898d9927b6dba695c98ebd3639
SSDEEP 24:7+tdqLpq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGS+:7MdqA5EpAuAriStwwuMN5meposS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/cn.telegram.messenger/databases/bugly_db_-journal
Size 8KB
SHA256 87cf1137266c47eb08f3a35e1959588c6d2e77b61e0f4c7b46aec9f75bdb2928
MD5 a88ab792e3cb13e21ffe10b722ba242d
SHA1 c7344a304e0afafc35c0b3b9ffbe59bfa3f19126
SHA512 032fdb03c69cd40c8fe71f8f36b0eec1d9193b292ebec8adf690b1e0bc717889bab92153a2e430e8b067d8f2a939c69662a856a91a9944d060ddb8e2ccde889a
SSDEEP 24:7+tOqLML+q5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSq:7MOq6V5EpAuAriStwwuMN5meposSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/cn.telegram.messenger/databases/com.google.android.datatransport.events
Size 56KB
SHA256 7c5973be05e24316bf7ec919990cdb45794834ed096d147707a834fdfa6353c0
MD5 82883d88baf35467665af40ee0a45e34
SHA1 179a58d1d021bce7db04d8d98a3c49e4561e27fd
SHA512 bcdfe78245c8835fa29a896d64264a6bb4fb29580e8f388d2330bc5850a53b62e1bdaaebbf939e325d32cf7867915fc13324a8cc49c6535d11da8860c2da7d39
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:8MEX0wIyNjao
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/cn.telegram.messenger/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a5ccccc4e7c4c7748be1426a2d899f6cb6d36b2b5ec5b78f4bdde022468889a4
MD5 64f2970f9e1154cbd7861c7abe119b58
SHA1 3b509000038ca895ed51461199200ce08f731110
SHA512 fd068f073bcb83038c5e4720ac669cf0df412bb86650127f73ed45ed803c9da6b7dbf6e4fe2cde5c3e3b6139ced79574dc7d5dd78d80bdfe0ace1a5c25be359e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/cn.telegram.messenger/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 50077ddc3a174c447b034223cf1c7a44a5872bfdcca460b02fe602a9005cad47
MD5 26924b70f2927c20c566a14f6b7cb0d9
SHA1 7143d37c2eddf7a640dc59e89d5ff5feea881fa3
SHA512 3c41db7f8269c205833bc20898eb87de45f86e1e49cc61d42a77fe2efef03f31355478456d1a4574ad7e9271e48304eb839696926be0a0df142207279ab36804
SSDEEP 6:7+/l9Vn1mRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKnn:7+tEqLiuWdwRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/cn.telegram.messenger/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c1c1df17e3a868c66e221fb051c7a155579a1d25030e0b27e608b932855e137b
MD5 c2afed567016ccb2176a8c2ae33e1fb5
SHA1 89af6b8eae6a9f1a54096b76481127412b451c6d
SHA512 3eb4dc0c51a9af38bee7159b005af724041d6773e35590ce49a82c4215d6d1b0cd2a6f625715c77ef7a5f9e9fcf779d5798984a55555ab8efe5d97a1dc1a0e75
SSDEEP 6:7+/l9LKHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKMU/V:7+tpKvqLJdTRmBEyPbN0V
MD5 SHA1 SHA512 SSDEEP

Submit Download

.cl

Path /data/data/cn.telegram.messenger/files/.jglogs/.cl
Size 32B
SHA256 e84cb3faad24bcae3a1cb8a736109e527c7e2209bd9bfacd8a9b7cc8f3aa3531
MD5 e6e16039a7a6c65d5b61790d7cdc14d3
SHA1 00239f9c660f0066fd83dccdfe37599dd746ab64
SHA512 56b14aa683a56b0df3eb1c2ef85c55503a786fce83f384fa7331ee9637b75aaa58303462d10095ec690a5f56aa455dc6221023f4dcbf59c6591cc398e05c6eaa
MD5 SHA1 SHA512

Submit Download

.jg.ac

Path /data/data/cn.telegram.messenger/files/.jglogs/.jg.ac
Size 40B
SHA256 f420fa04bb994e60a0d3c05f99d8bf7901289a060e7796997e184d6505c3d25d
MD5 05c52a20b62ae0b57b5c8655a06bcb45
SHA1 9565264fd25a2d1f7428a78bd22a28ac4074f017
SHA512 66e10ec077563f624dd7b553782f8ab66d95fe8bad3acf7e6c0388264bc7f731b0aa653da2698aced2a9b42e1e5d86cc596a9da28cc95821f6d4a14174fcee47
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/cn.telegram.messenger/files/.jglogs/.jg.ri
Size 307B
SHA256 143770148c7bcbcd20e3bae0097b03c72387518b14cfeb4d8486661b2c861c48
MD5 a5f8c53280e98f1558efffe45747a3fb
SHA1 4040d035f9e304cba894de997a231e2fc8073aac
SHA512 177a21f84e96b9920cf55b8bc8f06c1607f58525ff6b4517ae9d405b4a3d44cabcb005729f4f5b1b0fa7591af6c8f16a4f06c80907898bef1395507f8a1065a9
MD5 SHA1 SHA512

Submit Download

.jg.store.report_pid

Path /data/data/cn.telegram.messenger/files/.jglogs/.jg.store.report_pid
Size 32B
SHA256 7e3c3aa26f5dd231885d3b490b3bb8b07f2f47b7c3c26463ad571986f25b8d8d
MD5 eef05ac5a7d7bd4550061f10d14a255a
SHA1 bc20a5665b277abf7b98f00c81a880196609bb0d
SHA512 a02cc7805c0a65d09510a4822972b1d5d0b8c872c76e4cc7588e077c669b9f889943e1a3069655648e8f97fbd2025321e23a103392bbb73e804fd2ef59dac6bc
MD5 SHA1 SHA512

Submit Download

PersistedInstallation4384716917612879917tmp

Path /data/data/cn.telegram.messenger/files/PersistedInstallation4384716917612879917tmp
Size 90B
SHA256 c87942126b4664744fc365fe6c2c8386b76e720e71df6cbcdfd9e4e481ce9e47
MD5 dc2b2b9cea1b80ca6b6e8e63119a4445
SHA1 d4320b6eeff4f19182e0e712b1c6c1509dc077b1
SHA512 2291707a2297a3a30a104769523a691d9d1880296325d9768306f5196a8526f717747b621d7b563bcfa47a908b317824e4e9e65d45171bb3288cb2f34c459a5d
MD5 SHA1 SHA512

Submit Download

PersistedInstallation6397345082734331853tmp

Path /data/data/cn.telegram.messenger/files/PersistedInstallation6397345082734331853tmp
Size 564B
SHA256 6e295fca6045bd04e9ed1df0453e196e0c47dc621d1806d76dcadb27ae99da83
MD5 3979ecdcc0ae77e995de3130324cd45b
SHA1 0ddb908eb4b565e673be04ebc70f0b040566e125
SHA512 7cbfb72a6e0be71e28f2274d5c8877fe301bd6a79333f60c21d146b840fff1f995070ca9ceaaf7b85f5b7173560792e6f7720a8ca6f5c37901c83ca36a5c56ff
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/account2/tgnet.dat
Size 1KB
SHA256 44136accfdbaf534a1e23629d05ba53f56cdf07b533b2f2f5c596b17e45c6d24
MD5 8bf0d67aadea1dc8d50adb60f62668c1
SHA1 4bd3803d0fa616e8e052e13a84348ae4c4fcf204
SHA512 d32d7308284532a7404c3ade84e969dd0606ffd69d616758538dbc3c034e58a6f4fd5f20e1ff2678ca92915a7a17fc0d698f1c4a162c63410a7057bc1d44ccbb
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/account2/tgnet.dat
Size 1KB
SHA256 99134742812f7ea33632ab10552c120982d6f17fdd6e80576a7d7ed4a469f06e
MD5 a03d33f27d180c61920abd2f96a74c68
SHA1 3aa2b5f4b8c083b3eb9edb826c8dd873917ba932
SHA512 85ccff1783955d88de2e8de7ab41e1939e60207b3846f42cc8fbc97d90306e9b81667ce7db75604b0326f0963154dad17fc80e0184aa5aad131a89918ed3558a
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/account2/tgnet.dat
Size 1KB
SHA256 5dc95946e5c66f418094c841914d0a1b91601b1b52dcf547fcc263f9d4c49344
MD5 22c69b5504ec9f26d0575ecd071deb39
SHA1 99fb708999a2f0f2f6b9fda4fbbe17a31ee0e5b4
SHA512 435a9e7106c8c8494b5ca9a7360a9a3b20e8a0fa881bcff808cf4bbf0e1ca166d79d066971481c5cce9cbca2840b81b1de9daffd25a4b6b1dc92f61a806b1267
MD5 SHA1 SHA512

Submit Download

cache4.db

Path /data/data/cn.telegram.messenger/files/cache4.db
Size 4KB
SHA256 d4e1b9bdba21d5fd3b004eb02f191389d2b3e21f5a793af5d27a199f90c5493e
MD5 3ff674d0f9e82976113f39dca75b8f78
SHA1 fb1bf8a36688935c194e63dd8f18107e7033f5c0
SHA512 41eb558e3b75e601a0fdb733833c5504fc869ba664cb537b2e2c84353218a9dfb7f94b4f20957f38043bf336ffc7a201834e4c4a5217fd2761648ef7cbbdef7e
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/cn.telegram.messenger/files/cache4.db-journal
Size 512B
SHA256 5fd9d287ebcea24cd979af23dff810db2613c75d703d5f477a5d95bff9ca1bb6
MD5 cf00f7235b90b81b9afb7be67e599120
SHA1 8c0ccc5ed8b13c035a53d778ff8481f0b473a451
SHA512 cf7c7c950e79e05b7feffc36a9a2d13f4886c6b9fb0f32444c7cdf8e654ad8735134cb00b8f5f2ed43ecebf23daea1aabe2a4978ec0813be40ed98158c1d6432
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/cn.telegram.messenger/files/cache4.db-wal
Size 716KB
SHA256 af41fd51d4f1c151c20613e0966672f44c62b7148008fbeafedb93be384ddcbe
MD5 f007ec5326d774ea4bc5ce37d19066bc
SHA1 32288855dc1617a16e7dad41739a77c09e24b564
SHA512 e2c197b534f1d2f20303dbc102848b37ec34cc81cb88884594cf9d0dcede7a43a9b33f3973e975314a9d6f50303d2b8b831a49ce7a9276a43bff8cd3e1588b42
SSDEEP 3072:itTNzgpCLOyth1UebzbqajfQD7GJnC6xPmRCimbe7E52Rkq:
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc2conf.dat

Path /data/data/cn.telegram.messenger/files/dc2conf.dat
Size 40B
SHA256 87152114f80cd6a1b36e7649f2e54e18e347d15b45ca4245e1b2f20922a8f037
MD5 098b011c59a80daf15c048dfee00ff1f
SHA1 47963ffe950f64e4ab0d329f111f1ea61e1f72c6
SHA512 2caea2577cd87ab62be62621d976c650f14f063b6ef815d23f218b35b17354c95f2a56d595fce876750fcbb47ddbdfa844812e1218d77aa5249d85dd349e16c4
MD5 SHA1 SHA512

Submit Download

stats2.dat

Path /data/data/cn.telegram.messenger/files/stats2.dat
Size 540B
SHA256 3be78c120add8da0d94a6a7a515f2e85d64cfc1da0ce86d77e68dcd4e2b13ebf
MD5 f74e6ca08fd9a24bc88caaea0d0161bf
SHA1 09e9f61898814aba198c6e79f00b987e738adfff
SHA512 8daff31adbd036d8f3c8afbfeaa44b923e886a3063e081dc345192da0347ae90a6d0cf777646db71299d828d72d8de08f153542d357d00004a26dc2d1e05d4f6
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/tgnet.dat
Size 920B
SHA256 4845d5a02037390641c0bcecc8063e21d2aaaeb8a4b803f925605213b8fbb0e9
MD5 f56d5b382dddf773f3919a0f813ccc4c
SHA1 7195b23a5cda24fc9c7a4798d12e34874b27e43a
SHA512 2840bfb6f6200c2efe1f29f8ad24c17a7bbcafa8fc2ab969c2bc0c8ca83496211ba4f3945a46f33005d49c50f447630a03e92881f5a79cbfa8f47e11b87c5788
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/tgnet.dat
Size 1KB
SHA256 a1f508e7c1e4873a199bd19025bd107408b7557d3d06fffec882c4de96f6eef1
MD5 9757b977022e53f909a0347e8e97187e
SHA1 9a4807b7e0ce071613a27464bb4e719ae6f8aede
SHA512 1f976973aa75f3b11241a4463f31407febaa58ee925783995903622d326af5519893f722d342e728358a56d7f8c52e12ca4bc041ed1e9f0043839627d43ffc54
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/tgnet.dat
Size 1KB
SHA256 c65a9ba14a4c37d0e0c928567d93a1e4b5cc9d5ad4a3fafcabb18299f556d808
MD5 5b69158039935f8d192ae910837983cb
SHA1 58ff9f99532735d9f856da610d67c92f3ff61403
SHA512 b37c38e6772f91e5be0411680119ab71b46be63e689e0d334130981396f29c13b4fbc3031dc4536f0482c6b42e8223a9ec755605fc5c06760f3821caa2fc6261
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/cn.telegram.messenger/files/tgnet.dat
Size 1KB
SHA256 2232f1b7352043696654e1d94a6f444ce44847c63d64f5cde816956232967886
MD5 6955ee266d1a852d72a5dba7c7913dbf
SHA1 2afad05b70a7b85039b33d058df8392896163685
SHA512 8df8af010bac06c2119ae19615aeda97ec4b43c082aa1fe6fac06f9915af74321fb8c45a8fe3b7f5fd91d8e0d87e6b531051f3cc8d6e3b18b8fc2a216ca03225
MD5 SHA1 SHA512

Submit Download

com.google.android.maps.jar

Path /product/framework/com.google.android.maps.jar
Size 315KB
SHA256 67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f
MD5 4899aca36d1ed747a447dcac0d101a62
SHA1 32e43edc0bf3e036683ea8639472e6cd31ab9929
SHA512 50b23dd279a9efba566c6a6523c7537723c0cd6dd3e4871f1cbdb8d5bc355caa3ddea99452b1c8e5356802f812b3768066a9848b93d715bb8bdfa455b704285f
SSDEEP 6144:mm2CPwur8yS1kLsltUL93AZWQPgUwgZrnQjFKsg:Pk1VXkQVpmFKb
MD5 SHA1 SHA512 SSDEEP

Download

000000000_999999_temp.f

Path /storage/emulated/0/Android/data/cn.telegram.messenger/cache/000000000_999999_temp.f
Size 1024B
SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
MD5 0f343b0931126a20f133d67c2b018a3b
SHA1 60cacbf3d72e1e7834203da608037b1bf83b40e8
SHA512 8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads