badbazaar | a4b4d7130ee686dbebf1c189adeeae6014f737a13a5ce28a8e88f94d8a91bc15 | Triage

Sharing

General

Target

org.telegram.messenger_24327_apps.evozi.com.apk
Size

44.8MB
Sample

240520-gvffcseh33
MD5

9ba570a774455b4093dc04e6dbb85941
SHA1

bb8385e6850a169e5e519fd87119ce56c1c18a91
SHA256

a4b4d7130ee686dbebf1c189adeeae6014f737a13a5ce28a8e88f94d8a91bc15
SHA512

05cb6b22bbabd17cc2f3d091a36167fa8a88a40d6ddeb2b76865c5e810c5fb3a81b565c9719e5b99a3fe7ea0e0f72ef5bc7f36ea49d5fbf49d008443e044eff2
SSDEEP

786432:+juFTvGfppsThXMiuKg9x1qz7CPHIqrGifrnkwm6j:+jwTOfpp2MjBlaiDhj

Score

10^/10

badbazaar android collection discovery evasion infostealer spyware trojan

Malware Config

Targets

- Target
  
  org.telegram.messenger_24327_apps.evozi.com.apk
- Size
  
  44.8MB
- MD5
  
  9ba570a774455b4093dc04e6dbb85941
- SHA1
  
  bb8385e6850a169e5e519fd87119ce56c1c18a91
- SHA256
  
  a4b4d7130ee686dbebf1c189adeeae6014f737a13a5ce28a8e88f94d8a91bc15
- SHA512
  
  05cb6b22bbabd17cc2f3d091a36167fa8a88a40d6ddeb2b76865c5e810c5fb3a81b565c9719e5b99a3fe7ea0e0f72ef5bc7f36ea49d5fbf49d008443e044eff2
- SSDEEP
  
  786432:+juFTvGfppsThXMiuKg9x1qz7CPHIqrGifrnkwm6j:+jwTOfpp2MjBlaiDhj
Score

10^/10

badbazaar collection discovery evasion infostealer spyware trojan
- BadBazaar
  BadBazaar is an Android spyware used by GREF APT group.
  spyware infostealer trojan badbazaar
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Data from Local System

Protected User Data

Contact List

Stored Application Data

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

behavioral3

badbazaardiscoveryevasioninfostealerspywaretrojan

behavioral4