Extracted

• • Target

    signal.apk

  • Size

    79.1MB

  • MD5

    76351b5e3b9487b0b39759dbfea5f0c9

  • SHA1

    19e5cf2e8eed73ee614b668bc1dbdda01e058c0c

  • SHA256

    549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0

  • SHA512

    0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7

  • SSDEEP

    1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb

  Score

  10^/10

  badbazaardiscoveryevasionexecutionimpactinfostealerpersistencespywaretrojan

  • BadBazaar

    BadBazaar is an Android spyware used by GREF APT group.

    spywareinfostealertrojanbadbazaar

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Registers a broadcast receiver at runtime (usually for listening for system events)

    persistence

  • Acquires the wake lock

  • Checks if the internet connection is available

    discovery

  • Schedules tasks to execute at a specified time

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  behavioral1behavioral2behavioral3behavioral4