Extracted

• • Target
    signal.apk
  • Size 79.1MB
  • SHA256 549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0
  • MD5 76351b5e3b9487b0b39759dbfea5f0c9
  • SHA1 19e5cf2e8eed73ee614b668bc1dbdda01e058c0c
  • SHA512 0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7
  • SSDEEP 1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  badbazaardiscoveryevasionexecutionimpactinfostealerpersistencespywaretrojan

  • BadBazaar

    BadBazaar is an Android spyware used by GREF APT group.

    spywareinfostealertrojanbadbazaar

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Registers a broadcast receiver at runtime (usually for listening for system events)

    persistence

  • Acquires the wake lock

  • Checks if the internet connection is available

    discovery

  • Schedules tasks to execute at a specified time

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  behavioral1behavioral2behavioral3behavioral4