Overview

overview

10

Static

static

10

org.telegr...om.apk

android-10-x64

org.telegr...om.apk

android-11-x64

10

org.telegr...om.apk

android-13-x64

10

org.telegr...om.apk

android-9-x86

Sharing

Copy URL Twitter E-mail

General

  • Target
    org.telegram.messenger_24327_apps.evozi.com.apk
  • Size 44.8MB
  • Sample240520-gvffcseh33
  • SHA256 a4b4d7130ee686dbebf1c189adeeae6014f737a13a5ce28a8e88f94d8a91bc15
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
badbazaarandroidcollectiondiscoveryevasioninfostealerspywaretrojan

Malware Config

Targets

    • Target
      org.telegram.messenger_24327_apps.evozi.com.apk
    • Size 44.8MB
    • SHA256 a4b4d7130ee686dbebf1c189adeeae6014f737a13a5ce28a8e88f94d8a91bc15
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    badbazaarcollectiondiscoveryevasioninfostealerspywaretrojan

    • BadBazaar

      BadBazaar is an Android spyware used by GREF APT group.

      spywareinfostealertrojanbadbazaar

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

      evasiondiscovery

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

      evasion

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

      collection

    • Reads the contacts stored on the device.

      collection

    • Reads the content of photos stored on the user's device.

      collection

    • Acquires the wake lock

    • Checks if the internet connection is available

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Mobile v15

Tasks