badbazaar | signal[.]apk

Resubmissions

29/05/2024, 07:44

240529-jk595sfd9x10

20/05/2024, 06:02

240520-grv2msfc7v10

27/10/2023, 07:30

231027-jb7fvaef2810

Sharing

Copy URL Twitter E-mail

General

Target
signal.apk
Size 79.1MB
Sample240520-grv2msfc7v
SHA256 549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0
MD5 76351b5e3b9487b0b39759dbfea5f0c9
SHA1 19e5cf2e8eed73ee614b668bc1dbdda01e058c0c
SHA512 0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7
SSDEEP 1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badbazaar

Malware Config

Extracted

Family

badbazaar

https://signalplus.org:4332/api/
https://signalplus.org:4332/api/QRCode?imei=

Signatures

Badbazaar family
badbazaar

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 20 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

signal.apk

.apk 79.1MB

signal.apk

SHA256 549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0
MD5 76351b5e3b9487b0b39759dbfea5f0c9
SHA1 19e5cf2e8eed73ee614b668bc1dbdda01e058c0c
SHA512 0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7
SSDEEP 1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

Password

infected

org.thoughtcrime.securesmsplus

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION android.permission.REQUEST_INSTALL_PACKAGES android.permission.USE_FINGERPRINT org.thoughtcrime.securesms.ACCESS_SECRETS android.permission.READ_PROFILE android.permission.BROADCAST_WAP_PUSH android.permission.READ_CONTACTS android.permission.WRITE_CONTACTS android.permission.ACCESS_NOTIFICATION_POLICY android.permission.RECEIVE_SMS android.permission.RECEIVE_MMS android.permission.READ_SMS android.permission.SEND_SMS android.permission.WRITE_SMS android.permission.READ_PHONE_STATE android.permission.READ_PHONE_NUMBERS android.permission.WRITE_EXTERNAL_STORAGE android.permission.CAMERA android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.RECORD_AUDIO android.permission.MODIFY_AUDIO_SETTINGS android.permission.READ_CALL_STATE android.permission.WRITE_CALENDAR android.permission.READ_CALENDAR android.permission.RECEIVE_BOOT_COMPLETED android.permission.VIBRATE android.permission.ACCESS_NETWORK_STATE android.permission.CHANGE_NETWORK_STATE android.permission.WAKE_LOCK android.permission.INTERNET android.permission.FOREGROUND_SERVICE android.permission.GET_ACCOUNTS android.permission.READ_SYNC_SETTINGS android.permission.WRITE_SYNC_SETTINGS android.permission.AUTHENTICATE_ACCOUNTS android.permission.USE_CREDENTIALS android.permission.INSTALL_SHORTCUT com.android.launcher.permission.INSTALL_SHORTCUT android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_WIFI_STATE android.permission.SET_WALLPAPER android.permission.BLUETOOTH android.permission.BROADCAST_STICKY android.permission.CALL_PHONE android.permission.DISABLE_KEYGUARD android.permission.RAISED_THREAD_PRIORITY android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.USE_FULL_SCREEN_INTENT android.permission.MANAGE_OWN_CALLS android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_BIOMETRIC com.google.android.c2dm.permission.RECEIVE android.permission.READ_EXTERNAL_STORAGE com.sec.android.provider.badge.permission.READ com.sec.android.provider.badge.permission.WRITE com.htc.launcher.permission.READ_SETTINGS com.htc.launcher.permission.UPDATE_SHORTCUT com.sonyericsson.home.permission.BROADCAST_BADGE com.sonymobile.home.permission.PROVIDER_INSERT_BADGE com.anddoes.launcher.permission.UPDATE_COUNT com.majeur.launcher.permission.UPDATE_BADGE com.huawei.android.launcher.permission.CHANGE_BADGE com.huawei.android.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.WRITE_SETTINGS android.permission.READ_APP_BADGE com.oppo.launcher.permission.READ_SETTINGS com.oppo.launcher.permission.WRITE_SETTINGS me.everything.badger.permission.BADGE_COUNT_READ me.everything.badger.permission.BADGE_COUNT_WRITE

org.thoughtcrime.securesms.WebRtcCallActivity

org.thoughtcrime.securesms.messagerequests.CalleeMustAcceptMessageRequestActivity

org.thoughtcrime.securesms.InviteActivity

org.thoughtcrime.securesms.PromptMmsActivity

org.thoughtcrime.securesms.DeviceProvisioningActivity

android.intent.action.VIEW android.intent.action.VIEW

org.thoughtcrime.securesms.preferences.MmsPreferencesActivity

org.thoughtcrime.securesms.sharing.interstitial.ShareInterstitialActivity

org.thoughtcrime.securesms.sharing.v2.ShareActivity

android.intent.action.SEND android.intent.action.SEND_MULTIPLE

org.thoughtcrime.securesms.stickers.StickerPackPreviewActivity

android.intent.action.VIEW android.intent.action.VIEW

org.thoughtcrime.securesms.deeplinks.DeepLinkEntryActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

org.thoughtcrime.securesms.conversation.ConversationActivity

org.thoughtcrime.securesms.conversation.BubbleConversationActivity

org.thoughtcrime.securesms.conversation.ConversationPopupActivity

org.thoughtcrime.securesms.groups.ui.invitesandrequests.ManagePendingAndRequestingMembersActivity

org.thoughtcrime.securesms.recipients.ui.disappearingmessages.RecipientDisappearingMessagesActivity

org.thoughtcrime.securesms.DatabaseMigrationActivity

org.thoughtcrime.securesms.migrations.ApplicationMigrationActivity

org.thoughtcrime.securesms.PassphraseCreateActivity

org.thoughtcrime.securesms.PassphrasePromptActivity

org.thoughtcrime.securesms.NewConversationActivity

org.thoughtcrime.securesms.PushContactSelectionActivity

org.thoughtcrime.securesms.giph.ui.GiphyActivity

org.thoughtcrime.securesms.mediasend.v2.MediaSelectionActivity

org.thoughtcrime.securesms.conversation.mutiselect.forward.MultiselectForwardActivity

org.thoughtcrime.securesms.mediasend.v2.stories.StoriesMultiselectForwardActivity

org.thoughtcrime.securesms.PassphraseChangeActivity

org.thoughtcrime.securesms.verify.VerifyIdentityActivity

org.thoughtcrime.securesms.components.settings.app.AppSettingsActivity

android.intent.action.MAIN

org.thoughtcrime.securesms.stories.my.MyStoriesActivity

org.thoughtcrime.securesms.stories.settings.StorySettingsActivity

org.thoughtcrime.securesms.stories.viewer.StoryViewerActivity

org.thoughtcrime.securesms.components.settings.app.changenumber.ChangeNumberLockActivity

org.thoughtcrime.securesms.components.settings.conversation.ConversationSettingsActivity

org.thoughtcrime.securesms.badges.gifts.flow.GiftFlowActivity

org.thoughtcrime.securesms.wallpaper.ChatWallpaperActivity

org.thoughtcrime.securesms.wallpaper.ChatWallpaperPreviewActivity

org.thoughtcrime.securesms.devicetransfer.olddevice.OldDeviceTransferActivity

org.thoughtcrime.securesms.devicetransfer.olddevice.OldDeviceExitActivity

org.thoughtcrime.securesms.registration.RegistrationNavigationActivity

org.thoughtcrime.securesms.revealable.ViewOnceMessageActivity

org.thoughtcrime.securesms.stickers.StickerManagementActivity

org.thoughtcrime.securesms.DeviceActivity

org.thoughtcrime.securesms.logsubmit.SubmitDebugLogActivity

org.thoughtcrime.securesms.MediaPreviewActivity

org.thoughtcrime.securesms.AvatarPreviewActivity

org.thoughtcrime.securesms.mediaoverview.MediaOverviewActivity

org.thoughtcrime.securesms.DummyActivity

org.thoughtcrime.securesms.PlayServicesProblemActivity

org.thoughtcrime.securesms.SmsSendtoActivity

android.intent.action.SENDTO android.intent.action.VIEW android.intent.action.VIEW

org.thoughtcrime.securesms.webrtc.VoiceCallShare

android.intent.action.VIEW

org.thoughtcrime.securesms.mediasend.AvatarSelectionActivity

org.thoughtcrime.securesms.blocked.BlockedUsersActivity

org.thoughtcrime.securesms.scribbles.ImageEditorStickerSelectActivity

org.thoughtcrime.securesms.profiles.edit.EditProfileActivity

org.thoughtcrime.securesms.profiles.username.AddAUsernameActivity

org.thoughtcrime.securesms.profiles.manage.ManageProfileActivity

org.thoughtcrime.securesms.payments.preferences.PaymentsActivity

org.thoughtcrime.securesms.lock.v2.CreateKbsPinActivity

org.thoughtcrime.securesms.lock.v2.KbsMigrationActivity

org.thoughtcrime.securesms.ClearAvatarPromptActivity

org.thoughtcrime.securesms.contacts.TurnOffContactJoinedNotificationsActivity

org.thoughtcrime.securesms.messagerequests.MessageRequestMegaphoneActivity

org.thoughtcrime.securesms.contactshare.ContactShareEditActivity

org.thoughtcrime.securesms.contactshare.ContactNameEditActivity

org.thoughtcrime.securesms.contactshare.SharedContactDetailsActivity

org.thoughtcrime.securesms.ShortcutLauncherActivity

org.thoughtcrime.securesms.maps.PlacePickerActivity

org.thoughtcrime.securesms.MainActivity

org.thoughtcrime.securesms.pin.PinRestoreActivity

org.thoughtcrime.securesms.groups.ui.creategroup.CreateGroupActivity

org.thoughtcrime.securesms.groups.ui.addtogroup.AddToGroupsActivity

org.thoughtcrime.securesms.groups.ui.addmembers.AddMembersActivity

org.thoughtcrime.securesms.groups.ui.creategroup.details.AddGroupDetailsActivity

org.thoughtcrime.securesms.groups.ui.chooseadmin.ChooseNewAdminActivity

org.thoughtcrime.securesms.megaphone.ClientDeprecatedActivity

org.thoughtcrime.securesms.megaphone.SmsExportMegaphoneActivity

org.thoughtcrime.securesms.ratelimit.RecaptchaProofActivity

org.thoughtcrime.securesms.wallpaper.crop.WallpaperImageSelectionActivity

org.thoughtcrime.securesms.wallpaper.crop.WallpaperCropActivity

org.thoughtcrime.securesms.reactions.edit.EditReactionsActivity

org.thoughtcrime.securesms.exporter.flow.SmsExportActivity

org.thoughtcrime.securesms.mediapreview.MediaPreviewV2Activity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

org.thoughtcrime.securesms.exporter.SignalSmsExportService

org.thoughtcrime.securesms.service.webrtc.WebRtcCallService

org.thoughtcrime.securesms.service.ApplicationMigrationService

org.thoughtcrime.securesms.service.KeyCachingService

org.thoughtcrime.securesms.messages.IncomingMessageObserver$ForegroundService

org.thoughtcrime.securesms.service.webrtc.AndroidCallConnectionService

android.telecom.ConnectionService

org.thoughtcrime.securesms.components.voice.VoiceNotePlaybackService

android.media.browse.MediaBrowserService

org.thoughtcrime.securesms.service.QuickResponseService

android.intent.action.RESPOND_VIA_MESSAGE

org.thoughtcrime.securesms.service.AccountAuthenticatorService

android.accounts.AccountAuthenticator

org.thoughtcrime.securesms.service.ContactsSyncAdapterService

android.content.SyncAdapter

org.thoughtcrime.securesms.service.GenericForegroundService

org.thoughtcrime.securesms.gcm.FcmFetchBackgroundService

org.thoughtcrime.securesms.gcm.FcmFetchForegroundService

org.thoughtcrime.securesms.gcm.FcmReceiveService

com.google.firebase.MESSAGING_EVENT

org.thoughtcrime.securesms.gcm.FcmJobService

org.thoughtcrime.securesms.jobmanager.JobSchedulerScheduler$SystemService

org.thoughtcrime.securesms.jobmanager.KeepAliveService

org.signal.devicetransfer.DeviceToDeviceTransferService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

androidx.camera.core.impl.MetadataHolderService

androidx.sharetarget.ChooserTargetServiceCompat

android.service.chooser.ChooserTargetService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

org.thoughtcrime.securesms.service.UpdateApkRefreshListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.service.UpdateApkReadyListener

android.intent.action.DOWNLOAD_COMPLETE

androidx.media.session.MediaButtonReceiver

android.intent.action.MEDIA_BUTTON

org.thoughtcrime.securesms.service.SmsListener

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER

org.thoughtcrime.securesms.service.SmsDeliveryListener

org.thoughtcrime.securesms.services.MESSAGE_SENT

org.thoughtcrime.securesms.service.MmsListener

android.provider.Telephony.WAP_PUSH_RECEIVED android.provider.Telephony.WAP_PUSH_DELIVER

org.thoughtcrime.securesms.notifications.MarkReadReceiver

org.thoughtcrime.securesms.notifications.CLEAR

org.thoughtcrime.securesms.notifications.RemoteReplyReceiver

org.thoughtcrime.securesms.notifications.WEAR_REPLY

org.thoughtcrime.securesms.service.ExpirationListener

org.thoughtcrime.securesms.service.ExpiringStoriesManager$ExpireStoriesAlarm

org.thoughtcrime.securesms.revealable.ViewOnceMessageManager$ViewOnceAlarm

org.thoughtcrime.securesms.service.PendingRetryReceiptManager$PendingRetryReceiptAlarm

org.thoughtcrime.securesms.service.TrimThreadsByDateManager$TrimThreadsByDateAlarm

org.thoughtcrime.securesms.payments.backup.phrase.ClearClipboardAlarmReceiver

org.thoughtcrime.securesms.service.BootReceiver

android.intent.action.BOOT_COMPLETED org.thoughtcrime.securesms.RESTART

org.thoughtcrime.securesms.service.DirectoryRefreshListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.service.RotateSignedPreKeyListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.service.RotateSenderCertificateListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.messageprocessingalarm.MessageProcessReceiver

android.intent.action.BOOT_COMPLETED org.thoughtcrime.securesms.action.PROCESS_MESSAGES

org.thoughtcrime.securesms.service.LocalBackupListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.jobs.ForegroundUtil$Receiver

org.thoughtcrime.securesms.service.PersistentConnectionBootListener

android.intent.action.BOOT_COMPLETED

org.thoughtcrime.securesms.notifications.LocaleChangedReceiver

android.intent.action.LOCALE_CHANGED

org.thoughtcrime.securesms.notifications.MessageNotifier$ReminderReceiver

org.thoughtcrime.securesms.notifications.DeleteNotificationReceiver

org.thoughtcrime.securesms.DELETE_NOTIFICATION

org.thoughtcrime.securesms.service.PanicResponderListener

info.guardianproject.panic.action.TRIGGER

org.thoughtcrime.securesms.jobmanager.AlarmManagerScheduler$RetryReceiver

org.thoughtcrime.securesms.jobmanager.BootReceiver

android.intent.action.BOOT_COMPLETED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

signal.apk

Permissions

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.USE_FINGERPRINT

org.thoughtcrime.securesms.ACCESS_SECRETS

android.permission.READ_PROFILE

android.permission.BROADCAST_WAP_PUSH

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CALL_STATE

android.permission.WRITE_CALENDAR

android.permission.READ_CALENDAR

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.VIBRATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.GET_ACCOUNTS

android.permission.READ_SYNC_SETTINGS

android.permission.WRITE_SYNC_SETTINGS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.USE_CREDENTIALS

android.permission.INSTALL_SHORTCUT

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.SET_WALLPAPER

android.permission.BLUETOOTH

android.permission.BROADCAST_STICKY

android.permission.CALL_PHONE

android.permission.DISABLE_KEYGUARD

android.permission.RAISED_THREAD_PRIORITY

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.USE_FULL_SCREEN_INTENT

android.permission.MANAGE_OWN_CALLS