badbazaar | 1bfc484e80739c7c8a81c8804a60e26338328e03a6f4088c023eccd181313a77 | Triage

Sharing

General

Target

a8f9aa86971215ed95417b98403eac49.bin
Size

79.7MB
Sample

240416-b4sjdsec82
MD5

d343b71bbfeeec5865969bffeef8ca1d
SHA1

df2718cac44a0ccb8146463f6571ddb2ff6a0a6d
SHA256

1bfc484e80739c7c8a81c8804a60e26338328e03a6f4088c023eccd181313a77
SHA512

8b043e4bf84b4bd17c54a5f27ee042b809873d131ecac46bbfa81c02f3810f82a09c9297b6266226f334d41875a05b72cf478eaebeba0b7f0eb8316006c6ba20
SSDEEP

1572864:hv5d8Xxp+j1BGCGtyx71XPl6DZWMOqRF6IDY+Twdwa:h8+jytta7Zt65rTLMj

Score

10^/10

badbazaar android collection discovery evasion infostealer spyware trojan

Malware Config

Targets

- Target
  
  4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42.apk
- Size
  
  85.8MB
- MD5
  
  a8f9aa86971215ed95417b98403eac49
- SHA1
  
  bfcf6069bdfec516e78540f6140e80abf05516f7
- SHA256
  
  4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42
- SHA512
  
  dd997cf77c5f2acd05eb743ffd8d6efe030a18e1fd2d6022f8acc7169ad75e1d45d0a9169efc0662bea9458943c3745e605a71e9472edf8b78487325727b10e1
- SSDEEP
  
  1572864:TX0EWAIYcIkZ2TGiP3QWX/JMC5OwtdE/UteLa0jkXA8vBOHKOGUxKlYl0:T3WPRZsGQvvJR5vSUoL3kdBaY
Score

10^/10

badbazaar collection discovery evasion infostealer spyware trojan
- BadBazaar
  BadBazaar is an Android spyware used by GREF APT group.
  spyware infostealer trojan badbazaar
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Queries account information for other applications stored on the device.
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Acquires the wake lock
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Protected User Data

Contact List

Stored Application Data

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

behavioral2

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan