badbazaar | 4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42 | Triage

Sharing

General

Target

Telegram.apk
Size

85.8MB
Sample

240414-vlvqksdb5z
MD5

a8f9aa86971215ed95417b98403eac49
SHA1

bfcf6069bdfec516e78540f6140e80abf05516f7
SHA256

4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42
SHA512

dd997cf77c5f2acd05eb743ffd8d6efe030a18e1fd2d6022f8acc7169ad75e1d45d0a9169efc0662bea9458943c3745e605a71e9472edf8b78487325727b10e1
SSDEEP

1572864:TX0EWAIYcIkZ2TGiP3QWX/JMC5OwtdE/UteLa0jkXA8vBOHKOGUxKlYl0:T3WPRZsGQvvJR5vSUoL3kdBaY

Score

10^/10

badbazaar android collection discovery evasion infostealer spyware trojan

Malware Config

Targets

- Target
  
  Telegram.apk
- Size
  
  85.8MB
- MD5
  
  a8f9aa86971215ed95417b98403eac49
- SHA1
  
  bfcf6069bdfec516e78540f6140e80abf05516f7
- SHA256
  
  4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42
- SHA512
  
  dd997cf77c5f2acd05eb743ffd8d6efe030a18e1fd2d6022f8acc7169ad75e1d45d0a9169efc0662bea9458943c3745e605a71e9472edf8b78487325727b10e1
- SSDEEP
  
  1572864:TX0EWAIYcIkZ2TGiP3QWX/JMC5OwtdE/UteLa0jkXA8vBOHKOGUxKlYl0:T3WPRZsGQvvJR5vSUoL3kdBaY
Score

10^/10

badbazaar collection discovery evasion infostealer spyware trojan
- BadBazaar
  BadBazaar is an Android spyware used by GREF APT group.
  spyware infostealer trojan badbazaar
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Queries account information for other applications stored on the device.
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Acquires the wake lock
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Protected User Data

Contact List

Stored Application Data

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

behavioral2

badbazaardiscoveryevasioninfostealerspywaretrojan