badbazaar | a041bc05ffa20dc6df3387818a06329b54c84ca70cb281c0358d936aee0b3858

Analysis

max time kernel
88s
max time network
199s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
20/05/2024, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Telegram-Android.apk
Size 68.9MB
Sample240520-xenpssdc2x
SHA256 a041bc05ffa20dc6df3387818a06329b54c84ca70cb281c0358d936aee0b3858
MD5 7a5a2264a38d14ec36629301a1f97ed3
SHA1 9ff4d9a4fd79a6decdfc452d21f5954a90703398
SHA512 88bb457453d9831805199f588b24517e2f88a86fb1e0bafd3b1be3cb19b4ae115e6f42081aa723ec1653d6bfd6ea95601dc39b7893a7812f417e4b232f6843a5
SSDEEP 1572864:zbjAo4jkKsBxhMCb7ZMU1B+3cd9xXX0GQocKL:bcjkVhMChv1S+DfcI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badbazaar collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
spyware infostealer trojan badbazaar

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.telegram.messenger.web

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	org.telegram.messenger.web
/dev/socket/qemud	org.telegram.messenger.web

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/product/framework/com.google.android.maps.jar	5259	org.telegram.messenger.web
/product/framework/com.google.android.maps.jar	5259	org.telegram.messenger.web

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	org.telegram.messenger.web

Reads the contacts stored on the device. 1 TTPs 2 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	org.telegram.messenger.web
URI accessed for read	content://com.android.contacts/raw_contacts	org.telegram.messenger.web

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	org.telegram.messenger.web

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	org.telegram.messenger.web

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.telegram.messenger.web

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.telegram.messenger.web

org.telegram.messenger.web
1⤵
- Checks CPU information
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5259

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events
Size 56KB
SHA256 72d548d1861ccfcf2972d893fba2b8efb251c865efc0ed687897b74bf9f012b6
MD5 6dc45c386c5c30ebfac02ab8f55650e3
SHA1 9c52e8aaed788fd313f37312bc21f8cc93c393c4
SHA512 3e653e3eb267d7dfe25cfa1f66ea0bc1a9ad24b7334bd4c913269a5d07d4fdc55c12179195c62f7f595b3197dad82d5ff7cfc239b67beced34dbfbbbce918398
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSI:8MEX0wIyNjaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ff3c661ce3680c3090cb834e5ad8fd10ffc5ffae1b7df75d8b30cc4504d0928f
MD5 6671d7dc19984cb29ebc546284551ec3
SHA1 cdf35ec75848d89ee311f8ba22aa55491b67b800
SHA512 baa4146b4c6b9b5e1adceb2d7a221007f886ec5a9c7c8b508aec05563835fff438661bc0f47d7d2e7e54b206cefb66d076401bf9c5a66cdb46ce18aee09e12d1
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 712997c56374d82d92f259015101a01c153e780e79aca1753b93517e1f41502a
MD5 e43c5532639124b5b34dfb7f18d225b6
SHA1 9249892fc03b9c32fb88a6cd313beb518d2e3507
SHA512 4bcfc1c0edc51c3824b86e7cb50f7700a230aa223b47293cf5dcfe21a3ea561441fb9597ae3c0e6934a58622ea95937a08ea6ce02f83cae6de1ba80d28d85a81
SSDEEP 6:7+/l9n8Hn11l+Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+:7+tBWqLiuWdwRmBEyPb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 30c0a82f752422c91dc4c5d6126052f6e3db3c7e11ac46cea4a32ced64e3a59b
MD5 05a1955d57fc1a2f4da096ddce21f3db
SHA1 14cbdb31c70c70bc397d829d6bdb4fd04f543157
SHA512 91c3731d7b8ff23bc573f3fd1ca0b8528aa440674664510a332f6cb15106c715394867ae2705354a6a3f5f630c100ea3d0a32285a4eeba7b65804c45bccb905b
SSDEEP 6:7+/l9tFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKbkl//U:7+tFqLJdTRmBEyPbwklXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation1292412565059801872tmp

Path /data/data/org.telegram.messenger.web/files/PersistedInstallation1292412565059801872tmp
Size 569B
SHA256 b01830b7a5946ffd210011d15b2d59b41a84f65a0154cb29a53359fec6bc8513
MD5 e1d744812131fe7968a24b53344bd624
SHA1 ee37ec361fef34e50c1af78a45f1867e310e77d0
SHA512 2be257520be0ad294b7bc5ecd3ed6b5919c1d5156c052a87e23127e763dc1e762e5cb570904ae1a89132c255025562ff980c327f2695cc123354117476d7528c
MD5 SHA1 SHA512

Submit Download

PersistedInstallation5186725494936978244tmp

Path /data/data/org.telegram.messenger.web/files/PersistedInstallation5186725494936978244tmp
Size 90B
SHA256 dcb15d3837346954af515673699613f42ef4440324d94f8b18f4236539929f5e
MD5 6c95120404ecf0bc4c910b8c13ac7530
SHA1 2e6ecef6519af63d7429256713d3c9f5e0079711
SHA512 08cb1e3c43fc824d89ce3fe46f4d07d33d24da6c18bb209572ba85a6a0cbaafd5e241639edec20681adc3b8c8643a8c18c5d3772b3e80c2f0d68da9c09d02424
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account1/cache4.db-journal
Size 512B
SHA256 f7cf8ecf3fdae6243d061cb78a8bb3959492d54654a19198ff6eb997dfb1f580
MD5 01fbdf66417d8ee321239c9e47553a8f
SHA1 86011371564fc3e45676cdfc9215ab58a2e2d97d
SHA512 b783355770a2aa18598e0c85138a4f5eabd66b177649bbfaeca26ca5d33ae9f677ca2c5b031233c6456d2cac447d8f58b19dd9a3d2b938aa6a0be691ff84fef8
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account1/cache4.db-wal
Size 1.9MB
SHA256 86d16f174ab23123b0a66e5b1f64018ee5bce9be60495e4f7cb60f55c403877a
MD5 6cdcab531133c8013e3bb7f3fea29c9e
SHA1 e2269dcd3dfd97a7b1c642168c1a1ccdad0dc86d
SHA512 790b34130789df441e8830d632b0df2d8b94c248d0573e75f8e56adc9d0d5e7dc9fae8dd34986eae39554dd8797fa30e9c89585a9334920335b39aa5fec8a7e0
SSDEEP 3072:xorsfs3s4sOs8sbsosFsNsAsnsFsRsjs9sBsisG6VH4N15gfTQslKssUHM0j3Hde:+ji
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account1/stats2.dat
Size 612B
SHA256 18dfcd25e1f6fd46d59d12dcb11698cfcc9adbbd2b788c6c5a46d37ef8c25ace
MD5 392e5ac9aad027193a7143a2b56170eb
SHA1 5eda40e79ac17faf51925a4f44aa492754ffbf81
SHA512 d1169ce38107e3b52bc329df68c8015e5364978f6d9275b05f3046098dc6d656cf64bb7956e2b37e38c7fe9119c2fa1e25e01f0db00fd869c1439cd955adcada
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 908B
SHA256 ca9825f06c956c993fb246adb0491a1cb123409a3f1482b0f4a41e174da83cf3
MD5 84ad2eb97c649e6941fcb35e1c638579
SHA1 097a981a05f3c3a61f90688b8cea9b845e9c41a3
SHA512 ad26c87e1040a28430d68e475d30bc466a96510c6fcaf5c65bfb2c748a5af6647affbb3d194ebed6ccfd9f090d97dcf8c333e549092d7baa9363634631641912
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 912B
SHA256 3878e37026c9908ba4981cec5513fc99a6597914e2c58f6614433ad1d7af4519
MD5 21519c3498846c8c9848be209cb01148
SHA1 a3df5d006b089b2169142029b607304da09191b4
SHA512 dbf2ce04908daa1081e848e38d07e6e339de0ca7ee586f25dac78fe74b55f76ee93e160b0de28ec2a17008ea32a471e7ffd8b5e3ebcf0d7663d7a8ce16b78eef
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 ba37f7f4ee16a577387d317b3ad4eb5ef70f861e4af8caf9e0357f5341b8c619
MD5 8ceeefde3f036ece22f30c172331b7b6
SHA1 4394512bb083f44950d2572542e6d9e0a08f8be1
SHA512 3f4aa7396757b35c9771bbf745a1017df354333bf51fd04dd008f72ac9b9696eeaa90d5b663dc853b9891085e3836d26c5694233a34d715c3bf057c8bbcd24bc
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 f38834ed907d7f7852a39be0a776bee72ef7db697f1ae9389b5f1d88d97fde3c
MD5 d0561cc4858d0eae014d4d25ae7500bf
SHA1 491f7aeb46b3430c7eab1f348ee6381dc1f66eec
SHA512 5756a8e7d327b221f3303dfa24a51a1093cac4e72a72d05ea2e5853606a669d9ba0173879885fd9c24020b4e2b9bf3f0bb5a784c212558db0524412c33566991
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 4d51d3782f62ec3823469e60f0f45e10e3fd2aa3ed3037b9b289464343aa98fb
MD5 573aecf106e99ba365a458ab79757045
SHA1 1eac7f18d9ce58d3c94265c53cd16a74148e4f28
SHA512 efffae4f7246f526599debdcffcaaeeb94b1d06bc90dc981ae72baa16e0c1bd0116281ccd9247d47c85231e63f78dc56d30f159ca8ed40f925d54d98abbb03f3
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 d162b9dbf71b2e3d3cffbacd79f0039f81902672f466fce0ff995caf2555cfd3
MD5 33ba1320a6a11c9f8385a0ef097a3c24
SHA1 82898b6eb8d5a9fc88268d7f0000e91962b9ba32
SHA512 06cdbd3311afcf519f4b43b1b7acb10e5c4c484e086132bf8fd3c18a9ccf748b34f696d6397f2f28974be3ec887fb5e6c8cbefbeb2741068fa980ab01e8a52e5
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account2/cache4.db-journal
Size 512B
SHA256 58a2129e1b32dea2107f07a1d22235534c48a3295f995e485a848a958da8ec4e
MD5 83188e4a799a10ebc297d554ca1e19ea
SHA1 29cbd7e7aa10008d792d876577a132716623e15a
SHA512 8e3ac17d3d159f24231c74c83b350e0fb909e23246844dc757fc3486e97f91f30862d7eb7d982407e52a87f335d357c00b39962b59bfe4fe3d6cdfd78396154c
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account2/cache4.db-wal
Size 1.9MB
SHA256 30d10112b63f21481108f255e8ddfbe34d519cb3b40fd10d16a4754938e3ca31
MD5 78c79ba87fcb80d6bf002bdd12c47449
SHA1 318e70d982a373f8a63fe87d5efe695d4320acda
SHA512 359d744841f5c8babf22f00a6d833e05b835255667afece32a8d3a0dfdf98c710e99e10470b23754f2160d38ef62446dbeafd8f62484f38fdb51683a219e3ed3
SSDEEP 3072:6n9sesVslsMs/sQs4sAs8s5skszsLsXsmsqsxsyAJwEH1cgcTQnlK1sOH/0I3Ud4:RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account2/stats2.dat
Size 612B
SHA256 bb7b04312ed694e49a33b14e2cc2c6dbd2af21d07a16d32e044199e34421ef69
MD5 990c392e561589676f0139610acdf027
SHA1 cfb9cf8bd660037cdb4a7ab3805d3c51b514def8
SHA512 78e5a1ca2107eb9f730c0f8776f25552feb0c81fe5e6f096ba98d5aa44070ec938848d6911bd7989ca6c5b58ef8041d3eb4fcf08e4f84564df5a5f6cd115b755
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 908B
SHA256 a2c975c853110b51145fafb1492aa4156b63214b922480f4a5889f742fcf00da
MD5 1d1d09c9fc515ee4676c189869a1f14f
SHA1 b8d96df7802fb8a8be77ae96ca8f6139944794f7
SHA512 04f23afcdd67c184218609492874e5b40cee4efe6aefe5b69bed2c04710dab5421eb17d46736bb15b69fa94c34eee551ec5a3f3a81cecfd1dce93b0a0d7c68b1
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 912B
SHA256 93dd1e14121974fde2fbe34ea75d735273d593ba0c4d4efd1da5717673be7805
MD5 fba04e80f9fc9159eea9e2323dc91fd8
SHA1 c585f7554c8639e860f577a81b4b155d0e1d8baf
SHA512 e1d228290bfe08cf8420b29aa0945a34cf5eca3a8ec51c6da2ea43a2e8b316e83672deb1662cdf1f576c21e88207b6bc21ce0789703fbf5bea9d23be74f157da
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 65d2aa512148f40ba84d29b7a1a93a35baa611394c4adcb0bdfbb7cfc5720d5c
MD5 2ddc8e99362e334cc18159e93550a9ec
SHA1 e57fba86fa7e7ab0f129652896ed2f0db2c6f2db
SHA512 31b2547b1b42a91d712aece7b7c4dc5cedaea2efb61bc0d00dcb9742de6a3fa0288e558d6f0eb4b399002308af88ee6db268384c9863086168ec9f2f672f0d26
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 97b0da471c787cfb355506485ef1930e26788aa00babfd04810441a0b2062c93
MD5 320981939fe7f0e5b2e2794e78bda6e4
SHA1 8409c44b01a80bb2e0f5309db51e79cc3aeb216a
SHA512 0eb8c9a3cd29eaa4937ac80b9965109381b9c2c68d8ce3865820eead55f8dc4e7a1a74e7f7ef6c4ca59475fe10fc399d2223db58c7968e95e685cc4a988f5757
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 0017403577b8160201d84bf67fc5fef624627e30fb84e41369cbe6ac0f0e4697
MD5 d931687cc9a2e301a08d2143e287acf4
SHA1 c39e5bf380c27ad0164270c0b5a47b181a1ff32a
SHA512 70fb8163507c567f16d87a1fe99d7f157236df2081af0800751286dff6ed32eb0fd148f75b95346290e96a2ee00394a0bb6449e2d3949819d164016baa5b4cd2
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 dad4850bd61682731a3bd8e4c4c452983db3cc4cc40b0bdf6d4124f67f49f66d
MD5 81349a927eba7a755eb32f0a14189f1f
SHA1 5bcd4d5c8396e642a334a48a169071f10a167c83
SHA512 521ad5872172f7d151d32154f16e5a6639a188e0aef616a66d8c26d86222ee5f6db7ad58b4d5a7789abe3eacfe28300e4aec4c9c274b7b088dc00d8b49f53f19
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account3/cache4.db-journal
Size 512B
SHA256 9f098f678dbc6ea3595a1df9e8ab1639f07ccf9bf1e64ae10c06612b06890f5c
MD5 57b2a817e4d0ea00135bbcb9c4c50709
SHA1 87a3dafe34ce0d22387d7f979d51cd4ed814a011
SHA512 8d5837ced5fb25b197ddb504509d4ca0f6b069c6b0c7267801cd7bba0777b3d6b47b5f0d47ce46b5b3ba13af5619f85b153cc3663bce14741c33d38cf24d8ea2
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account3/cache4.db-wal
Size 1.9MB
SHA256 db77189ce7e70676c3b90107f4c2edcf910495aac8280f1490f91154ecbbe17a
MD5 827e50f892b90b15f818d3a8525df997
SHA1 e60ec33c07d54781c4bef23a79ff9dac3fb42d42
SHA512 8191a15cac5c7d0d029cdd560f04ea73ae5db9fae464ee315c9146737a86fd5f8653a1752024731363aa6f373ce002e7554b11e2366e0c14c5a0df31a978b026
SSDEEP 3072:8ZustscsGsFsEsdsmsfs1sisHsWsYsPsfsOs6sZlfpFm1FgmTQmlK2sfHZ90C3/e:mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account3/stats2.dat
Size 612B
SHA256 25c1d3a2d47bc0fd8f1892c5d62fe6092b0b4d1f70b97b630f2b3c37bee01145
MD5 2fce4bb9805af66d79d0964a07887ab9
SHA1 45c4161942bf3c597c9c5e3afebb55f0e1f9361a
SHA512 10c87da0706325e01c68c289a8bcee73c94205e9ce156df85dc0682734b54a2efd2a9c1e27a65fcf43ac728b358b26a32884ee718fbc4dd59b2c9eb7bc5bda53
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 908B
SHA256 ae944a93a2b969567e92240b0cae24b90a15fc9037d4d5e9368d870b8beb545b
MD5 f5e2a96d262f01b3e2c81b9129c13993
SHA1 2030d9d58e79f868066d493b513868d96952e072
SHA512 45658aee6dc3024fa2482d68b93e55bda6d38f18a729c095e4ae098d8ab57588cab78047a3a0686d92a96a22123232c6b921b03d990c435d563e5c33fb0334c7
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 912B
SHA256 7dad6ffb8ed11fb19d139464276bbcc9a52e6931a655708b829280737ec2ad0c
MD5 f1945050f1ddcb4c615679fe41f95b22
SHA1 7def4457271831c9ddb3ff4019d72e117b8946c5
SHA512 ceb3ab95c876bf17862450347b9a6269e7cfbde76c5b6851ac8683d4bea890c590abffba544240de836f37233cc4c75d17100ff20f2a8701c92d79ca10c6a0f1
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 ecf4b9dc9dad93f92ccf3d61327e96b6e1f4e6615f5f07ac732caca3065538c0
MD5 5aacb36471bcf4220aaa8ce7eecaafd6
SHA1 436ee0cbc47bbbedf372c36e178020a8342d6b81
SHA512 7687eb847837af8c092a98fac1c26044a38ed7aed89292aae471b02dd836eb97039495be3c705f18dbdc79f6f23eb266f7fbb77e49b8cbb6e104fc458f498901
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 dc588f4288bca238e007a762116f62bea1f1bb6e2f9c47ce47583db83f85cbf9
MD5 ec9eb06240a90e0dbfe5307ee1c7f7bf
SHA1 81b3bf4f0a963f99d664562bba618b2794ab35d6
SHA512 08e3edc4aa6ed666ed62af7c046c71e5ab5306c4ebb4f48e34a067a562869ebc322e02ac3f45c36702c01a4e89570cd067163e3292b71f60ee1c639dea250225
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 bb41e84f55b6862bde1d536c41727960615ea531d3b0298c60f10c21a8e4a61e
MD5 eff6b32f5b00a9430b2b2e33ada8d5dc
SHA1 e3dd7cd34990a7be056cacc66215a2cc8b1e0c4d
SHA512 e2323013f6f195b9d8507e2a5d72995a1c435d9c281c1f7d261a7834c96a4775fd7fcc51cb7323d2922b3e813a5e6fc66c357f96b26fc6790dd12b99aa863a61
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 0bd26c58d03e57d45709eea6165907223cc7a6f08a3c18949eab290ede8c1926
MD5 88d45f08a33879caa4971468a5345515
SHA1 4b1fc20b9e462de1965a93cd7c62cb663763d4da
SHA512 164adf413ede800b89b05eefb002cea77a12b2d53a583a8b8456ec4a8bd54ab4aa1fdb00718e5100d44336bbc6f1827d16e7abfc30ddb102a89148328cf2bade
MD5 SHA1 SHA512

Submit Download

bluebubbles.attheme

Path /data/data/org.telegram.messenger.web/files/bluebubbles.attheme
Size 5KB
SHA256 5a0501f6f3d29532ed149c92d35bbc94c5605f165ca65df03382a2907c69be85
MD5 9bf06cd276a81048c91bc2cb6eae76c1
SHA1 76ac360d39b5dad706015126484f0c0ae5da85b3
SHA512 e21e40c75f91bd8282e1aab3408ed9a960c75577d6ac8b63766f4ebbdd781e002d93d0ca85752098c86f3e4ae5228d72ea84397aa280cbc92d18575d67626165
SSDEEP 96:xE3GadtgoUYmPKcSTZeMCZh5fnt6yx1QtsOVX//lAcKtM6cz95QI:e3DtPmyc6Cz5fom1GqjczPQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cache4.db

Path /data/data/org.telegram.messenger.web/files/cache4.db
Size 4KB
SHA256 2a8c5af4b19e1144088ff271ec893e963a454107facb5f7155c2ec33cfa17b6a
MD5 689eb9d3d2a866648f68f76e6a8c3d46
SHA1 ba65af36973bb4cb831868ec4882ce204bffb597
SHA512 98392c13983b1dea2b080c383bd26cae10b411360df2fe4192bef6c0958b5f6bbff98ad876d2edbd8bd771f0e8519ad9c3cc50ceff56afec569bdae864b14d83
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/cache4.db-journal
Size 512B
SHA256 e65bb89c90e6e199540473ddd7d26864a2bf37ea0c36640b8f400953a74e361c
MD5 c37e3f71a01a49427aa81971c056063d
SHA1 f7c1bb651647af3e9b2fea527837e65e761669b4
SHA512 3e16450a8c9ee065a5a140c0e98a0a3ebda19a1142a4a707161f7dec8d9b75b0f6740ced482fa77fa648128352ad7b3349589b74d67e1353fda4a2b7f8f7ee02
MD5 SHA1 SHA512

Submit Download

cache4.db-shm

Path /data/data/org.telegram.messenger.web/files/cache4.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/cache4.db-wal
Size 1.9MB
SHA256 7bcf16fe1492b62258e1dceca85b6a9f683f7f04701e2a8367a8932a1395117a
MD5 981f479f449a76a5551314c5f21b6685
SHA1 603bdc0e6de8b6dc94276189c9a27f6d75ce5f54
SHA512 8d78f5cc2d4046079a0ec948ca9a3ee39c62852fca55f5cb1b20b288eb893ac06aa998c38062ea1fd4fc398e4599cd4d3d3143f83a3f2b3133d105f8f74e4bfb
SSDEEP 3072:JqRsMsRsus+sksUsZsRsnsases8s+sps/sisHsdYGhBe1AgKTQBlKnesRHd0i39z:QP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc2conf.dat

Path /data/data/org.telegram.messenger.web/files/dc2conf.dat
Size 40B
SHA256 87152114f80cd6a1b36e7649f2e54e18e347d15b45ca4245e1b2f20922a8f037
MD5 098b011c59a80daf15c048dfee00ff1f
SHA1 47963ffe950f64e4ab0d329f111f1ea61e1f72c6
SHA512 2caea2577cd87ab62be62621d976c650f14f063b6ef815d23f218b35b17354c95f2a56d595fce876750fcbb47ddbdfa844812e1218d77aa5249d85dd349e16c4
MD5 SHA1 SHA512

Submit Download

remote_en.xml

Path /data/data/org.telegram.messenger.web/files/remote_en.xml
Size 697KB
SHA256 aa33d246edd28779d8e12a1a01a44d33861fe9ec13c11ff914f469792ad7f7c8
MD5 785ea08195b3d2bec9c2b963c3a8f2d2
SHA1 fbfdcf8efde49f6cd468bb43c248fa8cc9243ca6
SHA512 6b98fe3936cfc8b65867baeb00f5671e882607165bef941ec9804ce2b6e8cd945d7f00eb7d4140e2f9bf7f4f27160f5fdbc013d34d66a2dba613c3d899cb670e
SSDEEP 6144:PLE2LUkaJ548QeMgLAY5TBsvV/4ypArwYN0GPxRYqdori6X3WV9wwuv9VlMRNINq:o8hQbLQ/4/5ousWV8A1FcQyiH
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/stats2.dat
Size 612B
SHA256 9466e860a949cc06dc2c1096ce15a64cf61a66d52fcde07aa6625f9401d22ab7
MD5 aec76ff0086a4025fc68f59191ade331
SHA1 d2e0f11c62374b91ed75c0eed5f1fc531bbbac0e
SHA512 31c8b8b55c6c4f77ecafe67bfb81214f81c696fe1b2310f0cd385e906cbde21d67cc23ebd51cf9863acf44540d4fd5baf4cdc483cc399e06751f580aef23fa2c
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 908B
SHA256 6f5369daafd7d0522118ae0aa1da3f1f725fd367bc4c276079ebb9285c0de87e
MD5 1ddb6b19ebff5413fb4d93ef1974774f
SHA1 3101144db7287daff8ae8b667bd82d68c8e1b763
SHA512 1b9383c2b57b7ed5b1cb8fc02b3db3df2c1f5f2d63f83bf6020338b1389e7be4deeaf79274b2db0bb1ec18413bc0213ef51a68279ed8fe075464c393ce4a8adb
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 912B
SHA256 727ed49a149c2816a4c4ac7e22821a53c9afcdb26bec0f346b06f7db902ab322
MD5 d30b6a640621ddadf857fed7aae9044b
SHA1 9a87aa6d408ee252235066b8199fe489eaca5182
SHA512 3c0ecbf1859ebb2e8af4158814a5f909c0ae93c08e1b5190d8d46c685d8d3e6e4bdb9ed51e3b94e09c34e4ba245cc169d9b0d4cdc720b0ce455119192bb4f735
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 6307fbb818db45fd4f234ece633f7fd7d7259fc507ae75e814ebc130d60cd7c1
MD5 2da49eccdc948f72d29a55a8dcca3e00
SHA1 ed0fc9117babbf9edbaa3d0f43a083e8fc91f9f0
SHA512 ba91011c8dcbbd1a10ca69d06e0465463b8cc1095909ba089a31713b424880c29f1f8ca35cf1905e063cfb796f44a396d120e6b9200758d71896d2e52fa58953
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 1bb87bd3fd24bc244cb743c92f43d02289c82e75d5f0ba616b39263b02030f3e
MD5 2f888a5e2f495f19a316bb94a47822fd
SHA1 073a81b3f76f18fe5a3f6040ad6e9d042ab4b07a
SHA512 abac0fe47c106ba2c745015bb75fd97bdf6c301c5be06cdfcac89aebd37e764008c3097e30c2b0ff82c0250568f3c184e1d15a1e2bdf8c628dcc81c0606374ba
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 32783904de529039a43be02dfc029be73afaa475f84735b2ab010ef0abaf0dcf
MD5 94e9f28ebc201cb61f60ff6ac1962e9a
SHA1 609c4f76831272d1259246ca052d247fafea38e3
SHA512 33806882b273fd54f4b04e37a1f935bd87a21c912e5486cb9d9b14ab70dda1211fc572dac9839bfd0c1fc4e0b3a342ba60e03fffaab6dd71185268c9a92d2f84
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 c1e290fa042d03ec205c8d99eada365bae256988d1551a80215b4b21e7cb19fc
MD5 0725e792e8b3aa7f77a4876fcfdfc3c6
SHA1 688b696a5fd6c35678af5be72db1da0d8fb3789e
SHA512 9083b182e8bb5f8f0814c9e2864ea06e85f6c6810053c1cf6548f9d3ea5bace8bd1aa474426747efdfb05e6f6e68edc4a7862e3b00c67ec42706d32461bbb8ba
MD5 SHA1 SHA512

Submit Download

com.google.android.maps.jar

Path /product/framework/com.google.android.maps.jar
Size 315KB
SHA256 67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f
MD5 4899aca36d1ed747a447dcac0d101a62
SHA1 32e43edc0bf3e036683ea8639472e6cd31ab9929
SHA512 50b23dd279a9efba566c6a6523c7537723c0cd6dd3e4871f1cbdb8d5bc355caa3ddea99452b1c8e5356802f812b3768066a9848b93d715bb8bdfa455b704285f
SSDEEP 6144:mm2CPwur8yS1kLsltUL93AZWQPgUwgZrnQjFKsg:Pk1VXkQVpmFKb
MD5 SHA1 SHA512 SSDEEP

Download

000000000_999999_temp.f

Path /storage/emulated/0/Android/data/org.telegram.messenger.web/cache/000000000_999999_temp.f
Size 1024B
SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
MD5 0f343b0931126a20f133d67c2b018a3b
SHA1 60cacbf3d72e1e7834203da608037b1bf83b40e8
SHA512 8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads