Analysis
-
max time kernel
778s -
max time network
924s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
28/04/2024, 10:03 UTC
General
-
Target
Telegram.apk
-
Size
72.7MB
-
MD5
3c1c87ec69fe57ae2aca6b24a1c819f8
-
SHA1
f4c7d1161a6fc09448bf56bb7cf27c3c11d4497d
-
SHA256
17a0d8c197feaa1dfa63d89713d30a3a02f879f39a35095343ad085be48e6b49
-
SHA512
c4ce9246fd1b62ada412b12fc03381470d6e2718dac79ce6202859ffe7e262c6b10059bd3a06330115c7ad9e476da29c68ae607b1f8e93f24b94dca271d15080
-
SSDEEP
1572864:AsI8T/iWuT4CK0EzbUqq+L0h7GldnkWd5fHYZWsKg6U40oq0wXQr25k:1bT/iBcf0Ezbzq+072SgJp6Loqt025k
Malware Config
Signatures
-
BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 2 IoCs
-
Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes
-
org.telegram.messenger.web1⤵
- Checks CPU information
- Checks known Qemu pipes.
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
Network
-
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.200.14 -
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A172.217.16.238
-
149.154.167.51:443https -
142.250.187.206:443tls, https -
142.250.200.14:443android.apis.google.comtls
-
149.154.167.51:443https
-
149.154.167.51:443https
-
172.217.16.227:80
-
172.217.16.228:443tls
-
216.58.212.194:443tls
-
172.217.16.238:443tls
-
172.217.16.238:443tls
-
172.217.16.238:443android.apis.google.comtls
-
224.0.0.251:5353 -
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.200.14
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
172.217.16.238
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5d06da7973502ef2aac8425dc3e038b71
SHA1002f28f5dd54b92e9b1ecc9972dd92b4d90a0c0a
SHA256a5a84bb078af14ec9576eece413688218bdf820e757ded62d937f36e8498ad6e
SHA512455f7f8dc08154cbb13e71da0eca697bc17c9da30e2b2cce23cc4bd5389d684570ebf984d8240bbc527bf26027974866fdccbe7db47d4189f5798e492b65c760
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD511fe5aa2d0859422ffdfcb0ef762ddc1
SHA1110686fe5843361750c4d1739aced4346d09a983
SHA256a1e7d76aeac2adc80eadfe530588006d9a6dd9a1dbf96802f45ef19ffe988baa
SHA5120d81779cfde62b8cbc440f0d8cc27057aa0cf324c9802122231952d7480caacabb21f6f6922f391883163a272cc48171f9ffb350315a85db600021737a5fc6c2
-
Filesize
90B
MD5f60f39d0b080d6fa78a253a4bab2bbd2
SHA18da1b28e3864afd453099162356af1525659c005
SHA256d51777b30ff4430dc75557273af9796680f3e35ef23b0cb071440611a0a3ee94
SHA5120aa64d4cb7287863a31ae777abb10afe49b45586950e55ee585d22473c05bc8a32ed4ca158f02b3e6fbd4bf124a8a97869477a766e07700a9ee4b73c017151b2
-
Filesize
567B
MD5ea2c90be0bda1933dfb50744ffccd6fc
SHA136f139325b9370b8725d91418c377811afc204fd
SHA25670280385102081222da68408beb85d8c3b77900a2be40601b385f1ffe0f6c2e6
SHA512515aa75bfe23785ad1a55a46c895d498bd96e885be8ae62b41b31f131b45c91bee32282ddc92b12c885acc40c92b592040e47ad11e490a400708798cd29cc44f
-
Filesize
512B
MD5691e1b860298c20952fe8664f36b17ad
SHA15534c2d6ad87d4946d176dd83ebec98a730ffbdc
SHA2563546ea69176952817d0918fac6bbbeb3a5d12fce69cd9febd0406d761e3e74db
SHA512fc6e2a643b8a2ba62e826eb9202ea557ece169f7bf43aa03d0ab6d3f805c44b4068e8cf7eafe9322bcdf6af5c28e9f698ce62ee42f7918c7718e3694da3c556a
-
Filesize
2.1MB
MD514f8e30e8bc230ee5492c71b0d95e6dd
SHA1fcec579d098a881d2452a5f7b2d16094b3ae77db
SHA256d1cea8ad40adcf83ec2705dd504363b9edd245cd99476e05fbcc7f9d1f1f7983
SHA512d60cd5aba055e31fffe7952eecb713f22300474f4b3dbf6e39da9cc8dcbeb059155c6d833d426501997f13ff4cf79261a5acbe130da8f28edbcead22b9e91ebd
-
Filesize
40B
MD5098b011c59a80daf15c048dfee00ff1f
SHA147963ffe950f64e4ab0d329f111f1ea61e1f72c6
SHA25687152114f80cd6a1b36e7649f2e54e18e347d15b45ca4245e1b2f20922a8f037
SHA5122caea2577cd87ab62be62621d976c650f14f063b6ef815d23f218b35b17354c95f2a56d595fce876750fcbb47ddbdfa844812e1218d77aa5249d85dd349e16c4
-
Filesize
612B
MD50d21f460de5e75bf228023a4197d17da
SHA189d990f5da6962bc3abd2c8dabbfb24e7b5960de
SHA2569142314c388b45f706c3a0b363f2d219297f27072030da8c76e77f4d5b7d5da5
SHA512349ec078658c3584112a5ebcc2217c2d847ac753ee4659b24ea4399df257b290e2503791b7365942d6f372f6f882f75cdca6c0039d998686c44cdb73527fa77c
-
Filesize
908B
MD528a81f98c7ab3cdd4c9c0d8b1272cf4d
SHA11d9b1f00b27e531984f8be4e3c63fe6659b6c994
SHA256e67795da69cf46cd455c1615711158d56e62d382e52a0f38052fe59b68e19629
SHA512bda040d46280ffb1935bf98ed8d114e6757b25fbed6691652a765efd8af17a4c2cf1dd01497eefbc9a463af330ce0cabe79fcfcb27ae44206803616aaa15ab9f
-
Filesize
912B
MD5d25dd8c0aca0f12a55cfc3101cf86c6f
SHA1b7ec6f7390ef0b96a10a5466b1dcfb58cbc929ec
SHA25699546d93bc3edab3c9a7466c1ab1b7943fef926ba8513c60e3ea624922d9f9fb
SHA512e6c7e96c987c9896729e9cbeda9c19fb9d5e830a1586716ea36c04b040758f1dd706ce81dd2b40a8a9b5eead7838454d2bdc4f5a86c331c61f921f2a217ff1f5
-
Filesize
1KB
MD5383633cd4fbf6f8ef8446ef639712901
SHA1b1dd1a79772c6fdcc8bcbaa9c74a373bb604659a
SHA2561ebd0f78f11cecc44dcb157f4a497fefeb9d7327a8111f55c897c97b60c33d81
SHA512fb5de6fa2d84bda9d9668ef4acdda059e493616383ebac9056bbf717e46afb37f89325b26fab16536db1abb72c5a61ddbbe6f116ccafca27cb2928a156aa2c49
-
Filesize
1KB
MD581d2842ea65cee189cdcc943b4d597ae
SHA184c1663ab2c9f93c13eab91aed3afe7f9a7d14d1
SHA256eaa7b57c923e35dc6e8b9893c4e9922030349df8aab5f24c91e3b028b5bc5339
SHA5125ef1592778e74aa61a754745e935db087d9e33b6e2525de77f72feb098d1948ba70f3910663213ea9b8d850e32a538293ee063514008d4e06a6a34d018f85303
-
Filesize
1KB
MD5cdae6455c3d88c8b8ce057b84a24d715
SHA1e353eda0365f364682b1623ff2cc0a57bbbf70a1
SHA25699cbc9017a5e0024e5919bb703e01310071f5ef1a71e15b8020b3d65ac84e5c3
SHA51261321e94c9e7cc3b44d347abf7dacf2b78dda8955c49fb8c5d9a2ee8fbe787ff7fbf2201cc404ccde20c84f4192468903cd822dbfcddf1b64dbe1e68ff591644
-
Filesize
1KB
MD542996935ec8d6dc9fce6d9fb746d5028
SHA1a7fec0783b1ed440e4506f69dfd52a0843605060
SHA2569276b8a507fdf3469b1f42ed6cbcf3f749d5b54163d47823a900650b91cf56f7
SHA5124a6956f65f8b88ff1117d1f8d9920719baf39a85b151357c9230dce56bd6cd96ac697ebe23167fabb1de57890e2a957a65b64a7ed93b1432029bc3b7bc067f79
-
Filesize
512B
MD59b6fc6545d76f5feae98c8d934e88c8c
SHA1080ef3aa449d09f0a406d7801f589d628ed89bf1
SHA256fbd4dcb609a443329a0d7393f196bb4a1fba0964906cdfe9cc51ddeacc9ba3c7
SHA5129856231668475ddbf39986219feeb01948fac7fa0e9faec67fb72544daf7faa4caa12b23d2775ad7a06bd62e181ccb0bbb253db5732c3905aa61b0f14e8b052f
-
Filesize
2.1MB
MD55b857137b2e6eb2dbff4df7f2d792b97
SHA1e9311a435acb22a2087a58b5c2d5eb5cc111c4d4
SHA256c91f426101d073596d82931fefa97fca7d70418966227931e0285f88492f6ce2
SHA5127fd0501bb41c4638e663dc367d080ab11b44eb5a376978b9637b5353aee4eba0c6b2c42ffad893afd402825f39d3f8e35cd678225d078072a2e4f19c25121343
-
Filesize
612B
MD5df650203752efc6da8cd3672eb1be0fe
SHA19fe10acf04ee52ea39dc3f2e895cebf3c33ddc57
SHA256ba543de1246cf460f1841ea89e34955a64924989a5040a769b8c5168b020be8d
SHA51268b3f9faa533eca79ff18ffb343fcbbc032e2931b45b19dfdf84f984cd250c662d0f23ca3ac98fd7401562805f7b6b850140e90d3ed2c41a65144bc783b9d256
-
Filesize
908B
MD550011bace06840b01f535d78ae0590be
SHA1334543ba07b9b14656eb426d18e6162246d907bc
SHA25650907fca550416bc13ed2119ae4c48a90a002701b212c3cdf8a3721777bdc65c
SHA5123afbde99fd4e751089e44b2f47e0d420f03a0131d9c4745315f83992e4c832e4cf134d228073560fddbb79fc1fd2a0f9cb10bce1e82b2bdc7fcbc52dc9d27117
-
Filesize
912B
MD5c414d776028c9d135062c578a804baf7
SHA1254d6c71247cbe18f22c6948671fbcbe531afacd
SHA256c48192127324c54053653fad84f7a6c88977e4b4fc419946a61db50407e698d7
SHA5129663c2ee306556a0ada02f6e295e1e1c2679077036d9f338a0af872d19a9d3dab2436117d11abd324993a9f316787046567ec5917dde90757f0bb7977efc3568
-
Filesize
1KB
MD5fb359a869c9b2f4925e0e42b996be118
SHA1ff802529c3eb51d20feceafc00979f89b3ba01ad
SHA25620dc2e4b448e91414917c4b1cf1a0f3731492cc9c9a044c9ee05fac0bafd1ce6
SHA512564a3818c9ee6a7c1c08ab9e8d87934c61f7cb5c9bc629e0188892f57a26b419cdc650465d6932460785d1bec36042fe0bea91a020a506f987af8ab04ba071e9
-
Filesize
1KB
MD5caa740e1d0dbc45dbd86c551c3ee4984
SHA108b858a68bda9f9873ecf940c8bd8d38631e8b9b
SHA256165d62531ddb1266fa531111a28c4cb5503523e20602b76b4d9f912f5064fa1d
SHA51248cf6d71c30131774b0d8ef5a65dc60c59e334e7c5c4e574f208007a6a71d08b339010986dd92aa9c0d3aa6cf601fb8abab2afc83956ab64d6d324635069d9ca
-
Filesize
1KB
MD51134256c1ad22d70d77f60c4e64d322b
SHA187ef825188781b350f7fbfa4e18efd8413bf72aa
SHA256109e702e953161de925e323467c44835cb56ae48cbbf915a9ab0f57cb54f27ca
SHA5121884230322922b6d830af1898d0d57259b19e6c2a9469359759c88813bf8131cf71f938066a622f7703a526761186ef71e430468eba840839997f0a02c8e82ac
-
Filesize
1KB
MD5f59c2d372e9b6979b7969731608ab0fb
SHA1421684ed8ab2852196452c74234bfab6eb04c7f6
SHA25670fb5c0a7d7a4e01d6f7c69c5365c342c7f6986b961a249266e26e6ff72a2c89
SHA51221802a6e9d2420c09baa290a25c0f142e9beaa26587c6c8ae267bbfdd34bfc56eb36a4687bc19a16699c1e90c5971a42ea638bd6e7184c36427292dcb68191eb
-
Filesize
512B
MD55bfebff04943cfa936e9540b7cfc12f4
SHA1b12287d4ad908c4799908cb55e411ed324c61fe7
SHA2567674ce28dcd13dc99cda4f7e1c379f4899e2cfc004f3faa38e22129ffc642cbd
SHA51262975f5e9944b0d95718f5ca21a41d5900baba38bbeef6914ba3ec8e7a8c89a14589557a2a82246956c9e7354b3ce08510ad8c14ab1d9196eac195d4c5284e8f
-
Filesize
2.1MB
MD58c9408d8cc4b12f226c7b2799be2cf5c
SHA18ac9b0a3f224eb5a91d00b7f17d0847378275932
SHA256bd08075e21f12a31e5a5379b62e5908c545a6c927062647a692240e0d0893b8f
SHA51231ead3e610afd82ce8c4ae61d6b522a938e9ab174312f3858a71db0cda115efc8e613429a6606033db6566702b00729dc2d6cde6c5b97318b0a9aafa4982ec52
-
Filesize
612B
MD5762e1caa3ea3f0f38b4a59867eda439e
SHA1397be0439711b4ee24c01d03d50b8ce643fd6f0b
SHA256b9cc932571c78fa25ac26d24d9f010b847f6112389c7bec6583d4195db71fef6
SHA51237e8d2dee91f320b783b1df4953326ceebc554905b00c67e8b8904a9cca1136d986c13d75981ef49431216cfe909421cb941516e4515d50289663b113e5d96fa
-
Filesize
908B
MD5c03d292fdf008052fd631ee55de05b44
SHA1974a1236a40ef6426c0e9bc925dcac1b857b7c1c
SHA256a187f50fe82becd93d6fd031a39b8735b84239dc66463150d33d3bfd2762d7ab
SHA5128dcc575ddb341e861faadfa1490be03631c890fa73fc4f4a101af93f66910064a69d1a7486fcf1e675e8afb7ce7095929becb00a967816fcacf2deff097488c5
-
Filesize
912B
MD5b3d2aaa73b5ccddc5334438a6469273e
SHA17b47ef09f6bf43c95c446e60348d109ef112dc60
SHA25663751013c74dc15651fbfb8a701eacee3615b53cc7b32175a69f28f3f06a6d8b
SHA51201e4a5f9cb1be655d0894fec4fa89b0cab3a70ebb4cec2bf13d033bb77f3467d062593cd890dd7c3ea35374ddb4f823d27612d13589f364fd26240795c76abfd
-
Filesize
1KB
MD52834c320daeefb62b4a7a71675811739
SHA16011782b4910a4d5598de32cad161754948a1614
SHA256464d23b21ffd99759755d82fc212a76b810c80ad0818bd17dce26bed24d3c01f
SHA5120573bbca3515302716f6bc8cd97d0639ee6ae2f52ae63b3216dba28ae2666e938514fe4c03e65088168fb24ae83862be1cb941a6e4d55fced4572bb6410e1202
-
Filesize
1KB
MD5ff721479b4346f8ce87dee5d7a6f20bd
SHA13121263b7450ad2064efe98ca46c6dc3fdea0334
SHA2564013cb03a4811de130493895da150c930ad706b1bfebaa9834179b48703eaa1c
SHA5122f90aadbea8df204959f8870b2a629211e358eec65e3bbfe0c0e4ac50599869639255139863a42765268201bd0e795d6b35580fdb91caea6d52b20ebdf493041
-
Filesize
1KB
MD506cceedd577323e7246bf27ce2cf60cb
SHA17d94ba336ae461e79c9d24a62a971b5024d2d227
SHA2560c0b28d5f4961b6ffc694381ab5449907d0abb28a6fe8e34022fe3937ae164bd
SHA512f50b0c569723f38ca5f47f3317f8397767a970a37f0aee4e076ac4fbcbb3021c91627e5853f63399eeb06576b55aa6ec3a2a689335eb291197f4c3f42da2b0da
-
Filesize
1KB
MD5983bb55cdb5aa7fbaf8fa1d7b5be0238
SHA1cafd67acf6e6aa6938e2c2429628caa8ecc815b8
SHA256b682b884ac50032fb3454607a21ccc8874bed8a3daf55bbdb0b2761c65cb824a
SHA512234fab88dc92e00fd85e4e0228b1013a2cbe0c9f30895ae4d1974d528b9d28530b4e38c792287b51aae4bb5bbfa9925dc4d59f96a5bf39ccaa46c0db45ed1b70
-
Filesize
5KB
MD5d4369613b827e02dccf6f597647cbf1d
SHA120a05edee6b1d543129f4d0cbf57fe7b2c5d4db0
SHA256ebbdda828dff50c92eadf086813bf9eb43df5fbc3581e4fa3fa1a87129fd8ac6
SHA512285a5bbbad021521be2f58c46e93e3d65335c2d2d09d6a7b9c4861ccd7b53cd82422a233097bbbd724d40728787472a86c6dd08023f34e16bf1ae6bf3dec67ba
-
Filesize
4KB
MD5689eb9d3d2a866648f68f76e6a8c3d46
SHA1ba65af36973bb4cb831868ec4882ce204bffb597
SHA2562a8c5af4b19e1144088ff271ec893e963a454107facb5f7155c2ec33cfa17b6a
SHA51298392c13983b1dea2b080c383bd26cae10b411360df2fe4192bef6c0958b5f6bbff98ad876d2edbd8bd771f0e8519ad9c3cc50ceff56afec569bdae864b14d83
-
Filesize
512B
MD57001ce0fedacf1389a745b0d55c6b85c
SHA107594abcc8271f043e73613f5b4b076f86168f82
SHA25601628c35234ad0460d71ccf95c984bb2edcb1744efef5e1e6353d2704ebc2e12
SHA512f6bcf65d388681a72c94062f0c95a865d3bb90be46eac6df27331c6bf6b2f9a3d7d447e556392106f69154d37a1fb59031e62945c5b8d28a62c512f464b8a1bf
-
Filesize
2.1MB
MD529a26f593ad798e9aeb93c3ae43c0e78
SHA1806a070909213ef3d745698eb7fd5ea436c2b24c
SHA2564280accfc0dd2ac0bbb6cc924e65e7a002fce25c4360f877a9fa6d36d677fed8
SHA512d77548f9f3861d68e3e42c5a22547b0f6253098c0c959bd64c508163cf93cc329300d9173ca6bd0780a46188dec7d6dabfa3827439c7b13853f3fc31e7385ec3
-
Filesize
908B
MD5ee6c377826085bd30152626db182b932
SHA1ec52c6d9189168f3fce73b6a9828218e7f198994
SHA2560acb6549d0a16397db2869e5a3e15b48f2242a0037736eb412e25330a4afb8da
SHA5128f38341ae78620d020d8510ddf5d15bcb069f6cdb900568a22498d395593fc0a9aad4ad956edf76ba9324c0c687becf8749e204bc4e25fdbbec3563e428c1371
-
Filesize
912B
MD56670c7c50f49dcdac8cf5fe3582f9a1a
SHA1e6778d664a0ec0156879687187e35ee3f181571b
SHA256096f820d2f12f67beb4e625dd3f156dfefc2147b48620260705014462495ef9a
SHA5126e9572b68d4e9463af738ae75da0a76cb03df574c05cd622c448a29c70c6ff1a6496caa8d5bc0a7fe857a0df37c568aebb54eb4808945bf895d60efd20eda90a
-
Filesize
1024B
MD50f343b0931126a20f133d67c2b018a3b
SHA160cacbf3d72e1e7834203da608037b1bf83b40e8
SHA2565f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
SHA5128efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461