badbazaar | 3e189844684ed85c0d0feb7535482bcfb9c29ba038da26c7ef355f13c1f3ff84 | Triage

Sharing

General

Target

Telegram774143.apk
Size

68.9MB
Sample

240417-nxf81afc3s
MD5

6f041a24c39f18f2afb45d028d0f2060
SHA1

492b9a7c96cc8921030201af13a3b9f930c0b40b
SHA256

3e189844684ed85c0d0feb7535482bcfb9c29ba038da26c7ef355f13c1f3ff84
SHA512

588805325c40ef9b43c40bb72e30a2761cda99f452e12d13b6b3ab77c442f3d6bda08e3ef458ef73ccb66b0db0118714f8c836ae038e6c45f4a6ffde9d404b1c
SSDEEP

1572864:0st8kNc/ytKmQsi+UJLX3iWQWDHdg4yL5mXK/zvgmEybEAjqk0wTqQdYTo+YO5X:0saTCbKXwKiHb/zITGE4qk0QYhN

Score

10^/10

badbazaar android collection discovery evasion infostealer spyware trojan

Malware Config

Targets

- Target
  
  Telegram774143.apk
- Size
  
  68.9MB
- MD5
  
  6f041a24c39f18f2afb45d028d0f2060
- SHA1
  
  492b9a7c96cc8921030201af13a3b9f930c0b40b
- SHA256
  
  3e189844684ed85c0d0feb7535482bcfb9c29ba038da26c7ef355f13c1f3ff84
- SHA512
  
  588805325c40ef9b43c40bb72e30a2761cda99f452e12d13b6b3ab77c442f3d6bda08e3ef458ef73ccb66b0db0118714f8c836ae038e6c45f4a6ffde9d404b1c
- SSDEEP
  
  1572864:0st8kNc/ytKmQsi+UJLX3iWQWDHdg4yL5mXK/zvgmEybEAjqk0wTqQdYTo+YO5X:0saTCbKXwKiHb/zITGE4qk0QYhN
Score

10^/10

badbazaar collection discovery evasion infostealer spyware trojan
- BadBazaar
  BadBazaar is an Android spyware used by GREF APT group.
  spyware infostealer trojan badbazaar
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Queries account information for other applications stored on the device.
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Acquires the wake lock
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Protected User Data

Contact List

Stored Application Data

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

behavioral2

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan