badbazaar | a041bc05ffa20dc6df3387818a06329b54c84ca70cb281c0358d936aee0b3858

Resubmissions

29/05/2024, 07:28

240529-jaxj9afa3z7

21/05/2024, 14:19

240521-rmybbagg9910

Analysis

max time kernel
48s
max time network
196s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21/05/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a041bc05ffa20dc6df3387818a06329b54c84ca70cb281c0358d936aee0b3858.apk
Size 68.9MB
Sample240521-rmybbagg99
SHA256 a041bc05ffa20dc6df3387818a06329b54c84ca70cb281c0358d936aee0b3858
MD5 7a5a2264a38d14ec36629301a1f97ed3
SHA1 9ff4d9a4fd79a6decdfc452d21f5954a90703398
SHA512 88bb457453d9831805199f588b24517e2f88a86fb1e0bafd3b1be3cb19b4ae115e6f42081aa723ec1653d6bfd6ea95601dc39b7893a7812f417e4b232f6843a5
SSDEEP 1572864:zbjAo4jkKsBxhMCb7ZMU1B+3cd9xXX0GQocKL:bcjkVhMChv1S+DfcI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badbazaar collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
spyware infostealer trojan badbazaar

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.telegram.messenger.web

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	org.telegram.messenger.web
/dev/qemu_pipe	org.telegram.messenger.web

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/product/framework/com.google.android.maps.jar	5324	org.telegram.messenger.web
/product/framework/com.google.android.maps.jar	5324	org.telegram.messenger.web

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	org.telegram.messenger.web

Reads the contacts stored on the device. 1 TTPs 2 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	org.telegram.messenger.web
URI accessed for read	content://com.android.contacts/raw_contacts	org.telegram.messenger.web

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	org.telegram.messenger.web

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	org.telegram.messenger.web

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.telegram.messenger.web

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.telegram.messenger.web

org.telegram.messenger.web
1⤵
- Checks CPU information
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5324

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events
Size 56KB
SHA256 d29e68f7ce0f46dc13c51633760a286c09e4b0fb0e7ecaa847fa267d4717b151
MD5 0c3cbe76e27eb91743f5246384105328
SHA1 75867cdbae680c2164e308647c31cf45864e9f13
SHA512 e809bcff1e88d288b7d3260db0d551f9b34792bcbc227c2a6afb1e0c375a0d0c450839238fc4dd6491080df65dafb1ddf872dca4d9810dfb1c8099fdb7b03648
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSg:8MEX0wIyNjag
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 736585ec2b3f011566bba92162c6db675f1792546c147406be1fc60de7764b07
MD5 1ed90ce79ee8cd6f50a4ede10cb584cd
SHA1 4e134f9f899f7eae3ffb80a37e77b3b6d4fd3a18
SHA512 2c3c23cfedd6409009dcc73d506aea41699c5e6efe0cc6b8dd88130e010b3df4d45c54ee81cdd22ade1da0755a05a2b5e5f20951f108002411e552d837e45bea
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2c15303e4f6b9d57d51cfdc4fc08ddd0acda921be818ddd44bf7ed34a4dbef46
MD5 4f3c069cd1317864378869ffe7e65abe
SHA1 b9f1cedf07b52ce8047378d09685a1aa89a8f5b6
SHA512 5907e84f0a3ceec174c8e68cc56c644dd5d08ed9d1b4c23f218dec43570c0031e24db971fa7a3209aee53ceaa9cfaae8e93d395933cd850cab5e75bbd5829065
SSDEEP 6:7+/l9DjUlFn1VsWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKENn:7+tNwJsWqLiuWdwRmBEyPbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9000fe35ee34a2aeae533b37172f7084d4252d220c55bca402d206f37de17708
MD5 ab67b8a760b1bd5e8a2c41cd5f0dfb9c
SHA1 08b4225f40c9f7366075c785de9ad17cc0d370cc
SHA512 db6304b03a4938e648b7f9b949c6da1ac93208db0c9004bb1ea0a9fcb36011918d38ef537fd157c8252deef9c4a5346063cf678a22fe736233694055b0b04845
SSDEEP 6:7+/l9CfGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKeh/K:7+tYf6qLJdTRmBEyPbnJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation4792862555173725111tmp

Path /data/data/org.telegram.messenger.web/files/PersistedInstallation4792862555173725111tmp
Size 90B
SHA256 cd2bcb8cc91f4fe25f9c369b5df3b1039f67803b5df49baf7055eb400bd8aa1e
MD5 db302e5b59fbedd26754a0eaad930719
SHA1 06c95fb1d10e210fdba1557e08953223ece6eb45
SHA512 807915f14439f2a4c134335beccfb43b8fb5efa345af2d8297c24e43206c53e871ff78d0d8175e5f5609d3275efcb3840905c7af3326af372d476d1d571392ee
MD5 SHA1 SHA512

Submit Download

PersistedInstallation5509778686814596881tmp

Path /data/data/org.telegram.messenger.web/files/PersistedInstallation5509778686814596881tmp
Size 569B
SHA256 7657cb5d9adaec82d1a9d4f62844adec1779b80e69378167f8fbadfed56e1dcc
MD5 357876edcc244eb9aa5afe2d2d9ae1aa
SHA1 956b4af8c7efb5c40a433b01524961126003636b
SHA512 9255f0f1b60183353b298592e7a822d28907f75d264eadef3d22a3b0c59eb603b34014eb419bb679b3373a06204e85c2eb128551bbe7320009b0ccd196373ce9
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account1/cache4.db-journal
Size 512B
SHA256 ed7527a9ad76fd7721630cc696d9bd918fc636c01330121f1314010bafef7954
MD5 ab85b7c6061e2b979acb3f3ee39d33c2
SHA1 41affcfc1b12253cd6bcdf9e850303e19eaed766
SHA512 48e9f1d6cc7fde47013c568afd4c40d0a36a516c7a4e8684818b5c9b5136d3c87948d7bf01d0ed31898a6197a4dcac6e00f759e9c961e02d21d8b06f7b0a1243
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account1/cache4.db-wal
Size 1.9MB
SHA256 1610745756fe3f090ce2f9c946fc8d6df8641aa2afe5ea53d83f81ef21749788
MD5 ce5b342124501c4ffec150de13ecc999
SHA1 923320bebf801dba64a43c079b5341ea7d6bc6a6
SHA512 51b37eec8beee975ca4456483c6c200d5d561a12641f198b5aa280f49ffb13957e61126eb582aec3fe7d3a3b6fbe37f62154cb8acdef343732cefd7464effa7e
SSDEEP 3072:7Eds0sLs7sGscsmsfses+s4+sBsiIsdsMsvsysFsX6nC/F1tgkTQelKIsHHN0D33:vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account1/stats2.dat
Size 612B
SHA256 05ee22c55c03965ce303cefa5167789b0e3d84a9d3b123fca8be17bb58b15eb3
MD5 053470c612f6a164ca9a90d5702cc32f
SHA1 ca0b3da067b8da8f691f5c91752f0136cd266a6a
SHA512 7f601dfee040c6d768de826bb98cac3665020d24322b10ef5132325cb58e97f981ea81a57e34b8281f53e9d1bc67cf1d342cf7dc1a93d9a3deee4bb650aaafd7
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 908B
SHA256 dd8d9d57c6a1f99d7df0e17973e1a57063b24030a64d86ce1a947a411b21bc5b
MD5 25cc91bc18463f67d32999b86d0e6fbb
SHA1 1ee1719e69c8aeb956fb48726bdcb7175ee83c51
SHA512 2b3b6679f77e863cc33a5d474fdbde64906b1c52e156857a0141f320f985f00bbf007093290ae7028d0387396f01040a18a36ed3bd88e988f9dcc57329113ae9
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 912B
SHA256 3c5dbb3fc645d386e4c718055e6bc00ac79fa83fe8c318635497bc43e5f1f72a
MD5 fd70084240ec01cb5dd01731623ada4d
SHA1 d6a6df8dd0703744935a8ffe5b1a222870f9de27
SHA512 28a1dc5e986ff70d73875d7d72d47b5f07f2960c71414a0d44dcc8750ae8defd0d7a39665cd60088bdfab813722dc51229189bb062089223c2e271c28d1853ee
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 09e946582bfc910f8e97392928e73c41e1f069443da29a7bfa69077b315263c4
MD5 332f8a6d1ba7b786a39c3e7bfdb93ae6
SHA1 84a169fcecbc88847cda3ce45e5c0c97b0cd8ea7
SHA512 df61e92fdcff76fe190d5ff3705b42e9806a8cb720c137cd1bbc2a198c1f8cc8fec6794b5e123623025410085621a6d0ccff5aeab49983fe8ea9dab38dc41bbc
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 1b7c0061168afc7170f7055191aff7daabc7303b933d8fafe1bba219767d53a4
MD5 ed4a84923176870f2ed1b7e2ab801490
SHA1 f23e81c4bf5726a9fd8a4294265d2f3dc49051f0
SHA512 7b9929a7320c13123d3b63660e9069e8b1f488c440ba67cab1bd885685ccdbc9846059f7cc7566185cb3ce8e3d378f2d53a1005f8c521f9c4893d49380d9c330
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 0b73d9580d66d705ff969017d095818796aec637924d72db33c41127d4623ea4
MD5 f24bd923934486115777384071e17ebd
SHA1 a5cd474b6dd1f626eec93be951c361ad7e1ca1a0
SHA512 a7aeeba7489a1f9ec152d533cb0920827f0dae35db8c9f63c33aa4ff4fa079270fac395bf51da41302831f580f307ec772d5939d0ed28fd87e9195686da4f6c6
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account1/tgnet.dat
Size 1KB
SHA256 ce1d8bd3580b78ce251dac5d5f841543aa56fca99ddd0e3429fb5e1c0689ea58
MD5 1dab52cb996b7a9ef0e4c9e821f6b2e1
SHA1 151c490154577bdb9243b7e19a6a95f2d7df708c
SHA512 4c9f7c043beed2ab7b26f6b7263cb5dbbe0997cfda25b97a78291ceeda9a324fc156f3c2d1b7d02593107ead31015f0d0be47492aad5d824b7edec1924273719
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account2/cache4.db-journal
Size 512B
SHA256 3ea347ac794c7f2edcf00873d1ac67fbc5ebf1c121e74e10289947a232e026ac
MD5 1c9961f2a8e57f13e8df691311db8434
SHA1 53c337f49451913fcce6058dbe1dc1205aed4911
SHA512 ac6672d294ea1e7fef6f5cb2ca36b01968b0e8d5331f8b2b90dae1740a8a68b82f02bae054f902931ed1814740d869403333744e192aa253aa3de981237455b1
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account2/cache4.db-wal
Size 1.9MB
SHA256 37f41949b0c346f10e30017c69379d11aef0f07c5d786dcd55ee4fb22aa32bad
MD5 60a4541f0b5b2cb8b31ad66e31e43050
SHA1 6bac520c71e7725492c90e2b374999350e99877d
SHA512 07f7dda6fb6a45f2b91bfe651e3a5be3b681ee33d515ffd36a369b17a6516388d6d3e903d4c5975948eee6087dd4926b9c0f6b4ce82cf14ea809621cc169f15c
SSDEEP 3072:lhrs8sVs8susTsHsosTswsqspspsTsps1shsrs9tH5jO1Eg4TQTlKLsoHJ0O3FdL:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account2/stats2.dat
Size 612B
SHA256 415d4c3e8acde9e377070d18009788e6ff3c8e489aabaee0d19fafdf6eeafc01
MD5 3a2523df93854dd30d73fd5faa004705
SHA1 2da274951796a2a4476ec26e2438bcb6ac8b1575
SHA512 3a26c7ffdf9315a4de9bc2ad55201f79b0614a257bc3f5277270fa99916623d012496b225ec4df646fe68a892e3c1b04ea38115e57c2c447c7db27da5811314b
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 908B
SHA256 7859de93a4fc17e0c0b6da91ffacf2ad586359b05fe670848245e590e77f7fe8
MD5 9a4809e82aa2ce6849abe8413b0ddc7f
SHA1 cb0e041c22ae08f61c12ba512be12400a7a9f453
SHA512 cdfe0bce3672a2cb73d04746b55c98c9fcd646a05e6ac027d75b1a82d94975f125fc90f0417200f91566172dec8da0b921a6b66f128a59ae35d59204acc4aff1
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 912B
SHA256 21a9dc4a1eb5e97c856a247d5446c0b333fc2f29a6549c495fe6c77430b7ab68
MD5 b45f40ce1f4be285f8509c0b2bc01a4b
SHA1 852128b6624c8e70f7e4170ce41e79aea53dcde6
SHA512 d5489cce9c8943ce316408cb4ec69fc108d9d6f54f0ac42b804e27a9bf8826d6f473305799924e19f0cd3f7298e4f7cc0cb40e2891f089e537f6321cd649c9be
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 69efc18018e5da53f69fc64edcdaf65e2d078cabb9cb664d256562d3da96931a
MD5 198cee89879d71503fc31fec78d11847
SHA1 5d2d7a3011c9b72297a790ed9bb971bf738d50b2
SHA512 b5c52599d893e6e34cad4e2e304493a9dba33a3e7653dd2afec6387d2d6f33754c7f32cb46d4efa9d597710e8a365e46760582c3ae47cabef8c98b29cb7d4e8b
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 398b5decaabba36d0e528d5dafe4f9fad61967226ab6e26638e5498be2e1216c
MD5 70374e08fa86c20490c2f97e0ec1c0f7
SHA1 b21702dbae2755b3ea8eb79977105452049510f8
SHA512 ce041029ebc49d471790718a69f0450d068f34630b289f7439b30474e84254fff0c298cb0d5482b20d84f426d02d0f6e01585e2129167dc93fdf9f0e354567f6
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 81840a60c0b2c8daa7c531dcaf8ee77c5dbc929768d6fe625c3261b108abbe81
MD5 c9b36a223643af0418ff900d915736fa
SHA1 ebb577ef1d48af01c95e9cf5d5582e10e4c0e0a7
SHA512 181a64be852540496883a773598b0b48f03fb87aa2f367d26a33c7e3fc3a8c9ccf8dafeab56afeba9c044f6fdd7f637e04a0f4237435af098221ab8269bc7699
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account2/tgnet.dat
Size 1KB
SHA256 1ccba446529b3fea55a2f65ce5555dc22b3ebc04b74e0243eb20112551559110
MD5 098f6a955f67c49bf2f44d659ac9f422
SHA1 c759b1f6eafa4f12570ae30fcd33f297cd2fc93b
SHA512 98ab8a5803fffd47b85165a910cbdc34bd53b47316e6486eed46dc013a4c3435eec3bd0c5969565b5aefa3689fc9021fe91b46458c33a65255610768da05c017
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/account3/cache4.db-journal
Size 512B
SHA256 858670594e8567eb6cde015519cec5d1b0299a02858eee85f817e11ef60357e9
MD5 6cce67735f1f5a7f86cfd079af56d9c4
SHA1 706e2270efe3b3b57eb965bf0a328a7042761ba2
SHA512 18f9e3c0470c518baf1755d1d41cca463cde39350eee851eccd4c47768cbdb564a886df4774156abd96e9b55d8362adbbe4ed808934ea4a5678a3a860e47b09e
MD5 SHA1 SHA512

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/account3/cache4.db-wal
Size 1.9MB
SHA256 5683fc1de4a8c28822b2cb9574d1fc300bd4b16987606c31aed8c816e8246591
MD5 124c900285eed9c5adbeb7608f359277
SHA1 a99ffe9e9ade58f1b00dd197366269f432d84c47
SHA512 6a606f214a9bb4053a51cf90d8bd42fb3f448d32bea6ca21db4d61252582f5a1cb405c4d84c2ca2569613ee2fce545573d19f05fbc87075ddfbc82ff016d479f
SSDEEP 3072:uF9sbsGsRs/sus1sssOsps+shsSs2sQsBs5sDosT6p+2b1RgATQFlK/szHW0e3H9:Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/account3/stats2.dat
Size 612B
SHA256 203bdec77c242adf013e9cb03089098cecaee41dd52066e77189406118222180
MD5 5552845c95f4d190b9c49464f77bbc0c
SHA1 c234c8343e4b95b0ccc8b658a4bbc73983f7725d
SHA512 a7670e2753f11dac8b0daa3b373397b3375ad8b679403b0a33ed68ce7d07d71742e2050f48b06070a2c5f26db53fbf7c96f9f5117a2743bd249b7b83a59fe014
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 908B
SHA256 01fb9218b15be1cc46fd12ee1c5ceb9fa9e8d431b752dcb038a400df0388af44
MD5 d7abc9a328010ab2490c1ae44e670f0b
SHA1 4a96ee0025ac078b96e2d137baeed8e729b14cd5
SHA512 94eec550cc730270d2725889dc2490d3a205ceb735cb2e205af606c7d8842d1b87554b9a4b37cabf59da450c4eb281cc94106134c563e5dbef56ca13a3d38f45
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 912B
SHA256 58fb1e65cfd7b29a1370b3725c7d441ec3e5e698a2a96ac6f30769256fd2fd8b
MD5 46977b390916ad312599c6f3c6812393
SHA1 7d04d6cc2c32b182d1cc02b478c184d818155dfe
SHA512 fe9edda76966d50578886a5eed906e4d0e18a632f393ae0720583c87a5ad880cab0264e7e06d2817fabbb2efab78f06c84b39b97c6bd64c7fdc36af53653c676
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 38079dc92235db193e8c077d1ea1126fdbd1258f341b62160c1198492547f99f
MD5 a8d702730dbd4624dfdc0dfdcc3bd24c
SHA1 112d2040108f5d6ccb914fdefc5efb8884e202bc
SHA512 795672c57982b5ade54a1328e65d64aa9aad90e32609a143efee92e0855bd313d615d10e8ae9e0ab78f06acfd5dfcd14662898456934832e83ef1854cf881fd6
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 74cc9f7d8a848e0658625b3c909f31458d06a656f3b3854882039d70b2386d3b
MD5 875bf09ffe14c5fd33fea2c47eeac759
SHA1 fdb8322cc1d602864f4b66569e39454d31c8631f
SHA512 95280e733c3234fe9c24d34b0fac573ad967cbdbaf7145a798ad78ccbc3981a67142c35a966629011063c045f29643d3061a378e2a664c1c7423d890e5bddb73
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 c16963d2ce8872027769550aec1b519d6b2af0d2ade3d334d6366b9b1697fee1
MD5 b6d4b3a0f7d113616d135f747cd23031
SHA1 31621b98dda58acaed6143799c3d7ca1bfe91c4d
SHA512 7e0b23ae426268fe287b193cf69b6e14c91a50e125a9799602f2240dc9580b66861315bfdfc8d157e6e3627653d2f2f303dd65df489130a3672806b5a5d7dceb
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/account3/tgnet.dat
Size 1KB
SHA256 f55573acd4afc8d88a780a497993c3ddd812c18c40e0c1c5c350ef2b4b94f08e
MD5 9c9a4b297d4dee2312d957d79f8757dc
SHA1 778571fce6c85dedc6c6e85402f22e35fa3d2905
SHA512 5ea9ac277a58356e1ae398519b40402cd7a0f8ff774a68e4d2244b2f93b1e5787227814a04395b2b9c8cc8d7ecbae3fb9bf6316604f76f9d17192f5e0befa4cf
MD5 SHA1 SHA512

Submit Download

bluebubbles.attheme

Path /data/data/org.telegram.messenger.web/files/bluebubbles.attheme
Size 5KB
SHA256 5a0501f6f3d29532ed149c92d35bbc94c5605f165ca65df03382a2907c69be85
MD5 9bf06cd276a81048c91bc2cb6eae76c1
SHA1 76ac360d39b5dad706015126484f0c0ae5da85b3
SHA512 e21e40c75f91bd8282e1aab3408ed9a960c75577d6ac8b63766f4ebbdd781e002d93d0ca85752098c86f3e4ae5228d72ea84397aa280cbc92d18575d67626165
SSDEEP 96:xE3GadtgoUYmPKcSTZeMCZh5fnt6yx1QtsOVX//lAcKtM6cz95QI:e3DtPmyc6Cz5fom1GqjczPQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cache4.db

Path /data/data/org.telegram.messenger.web/files/cache4.db
Size 4KB
SHA256 2a8c5af4b19e1144088ff271ec893e963a454107facb5f7155c2ec33cfa17b6a
MD5 689eb9d3d2a866648f68f76e6a8c3d46
SHA1 ba65af36973bb4cb831868ec4882ce204bffb597
SHA512 98392c13983b1dea2b080c383bd26cae10b411360df2fe4192bef6c0958b5f6bbff98ad876d2edbd8bd771f0e8519ad9c3cc50ceff56afec569bdae864b14d83
MD5 SHA1 SHA512

Submit Download

cache4.db-journal

Path /data/data/org.telegram.messenger.web/files/cache4.db-journal
Size 512B
SHA256 84af13a5abc44bc16021f4e84b353083d3e67e7d3cc1d5e3c0f458a07c5a2ba7
MD5 69e2f3bf8942764ffb53748d68cb933f
SHA1 202362117a38e2980c8f7909e8759da24d4dac6b
SHA512 6dea9755e47e73fcee3fa7f97cae02c8337f6cc40a36e2ba153d2b61f3434890ac328896f651b4d216074670a7390dc770ca83b297b09599de2aaa96fcb49075
MD5 SHA1 SHA512

Submit Download

cache4.db-shm

Path /data/data/org.telegram.messenger.web/files/cache4.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

cache4.db-wal

Path /data/data/org.telegram.messenger.web/files/cache4.db-wal
Size 1.9MB
SHA256 99bc35bd2ba333fe4cf1d1ed2a45c5aff56a07628e125d7bb6e49d04f31bb9e0
MD5 d74335e0cbae674670df20144f58be88
SHA1 8660a1443b880c7dce57dba7cf3d1f7b20dfb532
SHA512 c2bc98c7ba0d132300053c8db14b96c56d06d89573adc1fe0ae2c630eafa4e54f32c0657a8d998242ba3f683a9ab518d65446f46e27c4d1eb19511a738086065
SSDEEP 3072:mEMbsisns7s1sps1isms2sSsXsGsisTsys5sDsms+Vq5Q31JgsTQklKWs9Hn0I3x:Qm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc2conf.dat

Path /data/data/org.telegram.messenger.web/files/dc2conf.dat
Size 40B
SHA256 87152114f80cd6a1b36e7649f2e54e18e347d15b45ca4245e1b2f20922a8f037
MD5 098b011c59a80daf15c048dfee00ff1f
SHA1 47963ffe950f64e4ab0d329f111f1ea61e1f72c6
SHA512 2caea2577cd87ab62be62621d976c650f14f063b6ef815d23f218b35b17354c95f2a56d595fce876750fcbb47ddbdfa844812e1218d77aa5249d85dd349e16c4
MD5 SHA1 SHA512

Submit Download

remote_en.xml

Path /data/data/org.telegram.messenger.web/files/remote_en.xml
Size 697KB
SHA256 aa33d246edd28779d8e12a1a01a44d33861fe9ec13c11ff914f469792ad7f7c8
MD5 785ea08195b3d2bec9c2b963c3a8f2d2
SHA1 fbfdcf8efde49f6cd468bb43c248fa8cc9243ca6
SHA512 6b98fe3936cfc8b65867baeb00f5671e882607165bef941ec9804ce2b6e8cd945d7f00eb7d4140e2f9bf7f4f27160f5fdbc013d34d66a2dba613c3d899cb670e
SSDEEP 6144:PLE2LUkaJ548QeMgLAY5TBsvV/4ypArwYN0GPxRYqdori6X3WV9wwuv9VlMRNINq:o8hQbLQ/4/5ousWV8A1FcQyiH
MD5 SHA1 SHA512 SSDEEP

Submit Download

stats2.dat

Path /data/data/org.telegram.messenger.web/files/stats2.dat
Size 612B
SHA256 a55154e8d0fea37d9fb6ccbf8e4278626f58436a0bd96cf2977f30ede732bdaf
MD5 ae258d5f90b834c62b49c69ff318d93a
SHA1 2e0fee49af07dee23fd600e5006bf0775a3a951b
SHA512 b162c55cf1253ab25884907fd2354a78dfc7557d62a76f5dd6c31e93da9b87fa62bee4ce4babbee15fa254843ad3be05fe2b7a61f5a76451e86f4ef0264e5c16
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 908B
SHA256 9004f37a08d3a9338eedbeb3c35b105f4b7b3bbf5a7b13c0448a1c19c9eca123
MD5 2b791f21ac3dbec6af06dd65acb91376
SHA1 8b7e4940e864cc472de33cd2038573c944e1b8d5
SHA512 ab06d49a856c18954b48506a195a13736ff375c515a784c62c781eb02da2021bc6b0783a22aacf47a0fa5280d95f727883751d5ad2d0d3a42c5d92e11fb07972
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 912B
SHA256 49cee7436f8e4480c0f6d6ed7340c5daf429bd16df9cd2a633fcaf315316b8ce
MD5 d2555ea31629ea8ddc756713be8b0da6
SHA1 37c7b89ccfca55f303e7d2255a14a32f11dba263
SHA512 ce539fe995cce53cd402dc4c86694ce5d40e10d1ebb11c5749b39079003999c33159f1a1c27743f805bf737d765f89c38a3fbde25678479416738d5f6d3d9d2b
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 7b36f31badc79a181c81879c156f4b0dded2bf144eeb61550d5d91682800afdb
MD5 641605dd678a287dfade4bc4f6d13a78
SHA1 c7e47acfb2a02433b2b655a2498ee08666f7aa33
SHA512 537312bb16df01e815cf9b2bc3b58a89fe39a3dc6d8c31b8e4ef7a60f1126184f651f3d701634c9ee46b888c8ce5600944315d12c249765306be6fa125bec126
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 572d000cf10b21d4caca878d817ae412034d4e8947dce48dd51d884b3e3a1ff6
MD5 5b3d1c1e54a5c2fe6fa8d5476c9102f2
SHA1 b3d3ecfa53e5de573febbff919d9f9603f432135
SHA512 2317daf005638a87118d08088b83d96dedd6d667c4452379771242c9b6d82003f1bdc463e34d7672fb631d207b74dc41691614a74e504d904b3c312ca97a184b
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 d26a01206c04f49f0e993763455c6cff5972b57877e8523c1a71b8fd7a924ced
MD5 57a304df50ddb40e1d6d9a85e33dcbdb
SHA1 9c737b05f5baf5eefec23d2a6145576ce8fb62fe
SHA512 a2a55b9c8259c21ecea28ef8865d0e1b072cd88d00e74ab9629148f29387b28d3a21f9c8f3d3bd7d03d9c5fe6a4299c66a1d83ff73910edd4f2092f140b0e72e
MD5 SHA1 SHA512

Submit Download

tgnet.dat

Path /data/data/org.telegram.messenger.web/files/tgnet.dat
Size 1KB
SHA256 0acc20833fc789826243311fd5ac45fbb2950f029f499b7ea4326606ed5eb03a
MD5 d8bb077a965ac9c4cc3e204fda488507
SHA1 fba7ee84dcbd39ef91a51e9e696afb819e065133
SHA512 28b2c277263dc4f3141b986fbaa122a87e9e911fa0e69aff1ce1807104962f9bf6799a32491489bbd5cc10d69a45fa07cc5bacec0ae11fa5b88037e75d874db3
MD5 SHA1 SHA512

Submit Download

com.google.android.maps.jar

Path /product/framework/com.google.android.maps.jar
Size 315KB
SHA256 67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f
MD5 4899aca36d1ed747a447dcac0d101a62
SHA1 32e43edc0bf3e036683ea8639472e6cd31ab9929
SHA512 50b23dd279a9efba566c6a6523c7537723c0cd6dd3e4871f1cbdb8d5bc355caa3ddea99452b1c8e5356802f812b3768066a9848b93d715bb8bdfa455b704285f
SSDEEP 6144:mm2CPwur8yS1kLsltUL93AZWQPgUwgZrnQjFKsg:Pk1VXkQVpmFKb
MD5 SHA1 SHA512 SSDEEP

Download

000000000_999999_temp.f

Path /storage/emulated/0/Android/data/org.telegram.messenger.web/cache/000000000_999999_temp.f
Size 1024B
SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
MD5 0f343b0931126a20f133d67c2b018a3b
SHA1 60cacbf3d72e1e7834203da608037b1bf83b40e8
SHA512 8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads