Overview

overview

10

Static

static

10

4f2de912db...42.apk

android-9-x86

10

4f2de912db...42.apk

android-13-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a8f9aa86971215ed95417b98403eac49.bin
  • Size 79.7MB
  • Sample240416-b4sjdsec82
  • SHA256 1bfc484e80739c7c8a81c8804a60e26338328e03a6f4088c023eccd181313a77
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
badbazaarandroidcollectiondiscoveryevasioninfostealerspywaretrojan

Malware Config

Targets

    • Target
      4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42.apk
    • Size 85.8MB
    • SHA256 4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

    • BadBazaar

      BadBazaar is an Android spyware used by GREF APT group.

      spywareinfostealertrojanbadbazaar

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

      evasiondiscovery

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

      evasion

    • Queries account information for other applications stored on the device.

      Application may abuse the framework's APIs to collect account information stored on the device.

      collection

    • Reads the contacts stored on the device.

      collection

    • Reads the content of photos stored on the user's device.

      collection

    • Acquires the wake lock

    behavioral1behavioral2

MITRE ATT&CK Mobile v15

Tasks