badbazaar | 17a0d8c197feaa1dfa63d89713d30a3a02f879f39a35095343ad085be48e6b49

Resubmissions

26/05/2024, 13:10

240526-qewl3sgb95 7

28/04/2024, 10:03

240428-l3ntxsdd6y 10

Analysis

max time kernel
6s
max time network
1010s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
28/04/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Telegram.apk
Size

72.7MB
MD5

3c1c87ec69fe57ae2aca6b24a1c819f8
SHA1

f4c7d1161a6fc09448bf56bb7cf27c3c11d4497d
SHA256

17a0d8c197feaa1dfa63d89713d30a3a02f879f39a35095343ad085be48e6b49
SHA512

c4ce9246fd1b62ada412b12fc03381470d6e2718dac79ce6202859ffe7e262c6b10059bd3a06330115c7ad9e476da29c68ae607b1f8e93f24b94dca271d15080
SSDEEP

1572864:AsI8T/iWuT4CK0EzbUqq+L0h7GldnkWd5fHYZWsKg6U40oq0wXQr25k:1bT/iBcf0Ezbzq+072SgJp6Loqt025k

Score

10^/10

badbazaar discovery evasion infostealer spyware trojan

Malware Config

Signatures

BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
spyware infostealer trojan badbazaar

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.telegram.messenger.web

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	org.telegram.messenger.web
/dev/qemu_pipe	org.telegram.messenger.web

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.telegram.messenger.web

org.telegram.messenger.web
1⤵
- Checks CPU information
- Checks known Qemu pipes.
- Acquires the wake lock
PID:4353

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
d9743799281069985cd130cdd86a0c56

SHA1
62f0ed0c986e93b807a5d6f851470a3cb6937ed3

SHA256
8984ac051446e88d54e0cc6680c069df37e8482007a12f5fd48de2a2589f22f8

SHA512
17368199e5632d3f6f1fd0f5f1f4c888ecbe876e4a7ce7d26c8dfc7c50cf850f21d812cc78ec656dc8262f1bbb48bae195872c64c8a6a24f0c29dfb410823605

Download Submit
/data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
ad29155776150eff80e032f2098326b0

SHA1
dad92f5a6aa609f4421dff79183417e791b29c8f

SHA256
8143f39aeca4426d3650664ce9bd9cde80213d890a300f3a493ececec58b4880

SHA512
bd2635d6f314514f332f48a37cebd8b129e55b76cc3cb3c16905a465cff8662c3499935923e25b7d9fd6d117497bd734930baf46e7d5d99df1bc8f5a3b6467ec

Download Submit
/data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
2a31928d822ce8fbbdcb4641b90cee01

SHA1
31f7a345e7fb615558e2c2128a78314a85c2a689

SHA256
be343724f5effb89195e4a69c599d027d4937dfad55f982b85b5485ae138e2e4

SHA512
d6e1ffca7fa0beb955a364e6a90c0bab54dfebcad453fed06c9afad383a12c5336fa7e25be3b8067c22fccefd8c303db41bb8c935953c5a5198447eb8a6b887d

Download Submit
/data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
421a0083ce9d8c9a2fb1e08eedc4604e

SHA1
54add853777fa9a3b942a578888b8ffed6c214bb

SHA256
dd3552a8eec3a96f22e8e14449da2b32c5f80ee36bff8277b2190ea0bfd2f129

SHA512
8824db02beadcd3caf8272faa61a2b6682f943f65b841c7563b7f4135d59e71848fd897f8b0902d200c643c3d14cb36bddddce6e3b8d274e7e3bc12a4a87bef9

Download Submit
/data/data/org.telegram.messenger.web/files/PersistedInstallation4699527318116966257tmp

Filesize
568B

MD5
6ce068da97e2c7d5f2df9ea3ffb88330

SHA1
9df8d0f83b822dc2bc00d6b79ad4037dd7c2bf75

SHA256
791777cced3497b792780f6a28c21fd8b6c48339105717ddc14c6b4a7055fa98

SHA512
86cc24f43c2801724cab6502abde88a462d3e185ff3864cb8c19fb0dc4d155dbcfcc39b3dec6cdffec08399e499eea545239836f1ca17622f4c87f8064423123

Download Submit
/data/data/org.telegram.messenger.web/files/PersistedInstallation929874928276218820tmp

Filesize
90B

MD5
78fb840821bc268fe1482cfd0480a0fd

SHA1
dcc05fdafddc6b2a87b908e778bee5b07d9930a7

SHA256
5392e3ca81699c96f3e725ae6e7a944bc47add91cf143c5f4fd1d18e33ad6afd

SHA512
b04d60a2877930ea66b484cee319b431337a38d4c501f550127ca7a33cf0b68e40fa6ba846ffc9cba8e5ea307d8eca11ed3763fe1cfab82d0134a0d5ae405107

Download Submit
/data/data/org.telegram.messenger.web/files/cache4.db

Filesize
4KB

MD5
689eb9d3d2a866648f68f76e6a8c3d46

SHA1
ba65af36973bb4cb831868ec4882ce204bffb597

SHA256
2a8c5af4b19e1144088ff271ec893e963a454107facb5f7155c2ec33cfa17b6a

SHA512
98392c13983b1dea2b080c383bd26cae10b411360df2fe4192bef6c0958b5f6bbff98ad876d2edbd8bd771f0e8519ad9c3cc50ceff56afec569bdae864b14d83

Download Submit
/data/data/org.telegram.messenger.web/files/cache4.db-journal

Filesize
512B

MD5
8483a2adf53a1cec459febab3a1cbc81

SHA1
d4c8d81b6c3e3661253ba1b49069f3ea21f2cfa2

SHA256
516bb025bb6028049400db0537e2a0ac88d67b1315034c101b9d842f62dbcbc4

SHA512
22c6574c9590f8bd8582b45d3f9f388a30fc3e385404df1332cc6bde6f54a26f1afe14be0b2f942846a2e822b6051059799e15add8dfd49218d6304b111a92a3

Download Submit
/data/data/org.telegram.messenger.web/files/cache4.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/org.telegram.messenger.web/files/cache4.db-wal

Filesize
1.1MB

MD5
9fcbfc2b2da7cce1e6e3f59d35ace91f

SHA1
047ea24977d9a103357cb1f29360db0e90d85b5b

SHA256
2ee79d0bae1cdef6f87f8226181fd7c94f0c73afad33289686a3cffe892f4e80

SHA512
5891885ba70578686da480637ab3563c90668baf12080e1f3aef386659a62b6c437063baf7c38217cc114a4001b4e83199d3c0f822457e6c052e39e23aee8219

Download Submit
/data/data/org.telegram.messenger.web/files/tgnet.dat

Filesize
908B

MD5
21004a54ddcc7006e838718df30e4ad2

SHA1
175cf3172b09a8c1a8cdefafefbae8ffda608d29

SHA256
de7c33bec4e8cd2e435276d64a712db41e0ae008e5ff56c001bdb9dc7fe770a5

SHA512
3cc3ac02ebc3e22412faf761d839c0851c947625e741f24bc877414845829f3c99eb16f6302dec807e955838fc316de67ed68ccd0538ef2fc37cb5d0c136f144

Download Submit
/data/data/org.telegram.messenger.web/files/tgnet.dat

Filesize
912B

MD5
2864eca3fbbe76c8aa26c959f056f835

SHA1
a4b2349cfcba1d6ea578b07a8e4b23ff3b53f239

SHA256
e98f13a9c1075c41c22ec3c57db66c04b7a384eadee491a5c5cf2d9cac866669

SHA512
b09d1bd84af9d96e70f0862377b52f8ae0644d23931fc7b9c856996ee4471d37963df88e645e400ff93625b12be14a97d59cb89262cb66922f9e2dd46ef049d0

Download Submit
/storage/emulated/0/Android/data/org.telegram.messenger.web/cache/000000000_999999_temp.f

Filesize
1024B

MD5
0f343b0931126a20f133d67c2b018a3b

SHA1
60cacbf3d72e1e7834203da608037b1bf83b40e8

SHA256
5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

SHA512
8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads