Analysis
- max time kernel
47s - max time network
100s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
- submitted
22/05/2024, 22:30
General
- Target Telegram.apk
- Size 72.7MB
- Sample240522-2fa8babe25
- SHA256 17a0d8c197feaa1dfa63d89713d30a3a02f879f39a35095343ad085be48e6b49
Malware Config
Signatures
- BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 2 IoCs
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Checks if the internet connection is available 1 TTPs 1 IoCs
Processes
-
org.telegram.messenger.web1⤵
- Checks CPU information
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
PersistedInstallation104236871113927510tmp
PersistedInstallation8243615423488820874tmp
cache4.db-journal
cache4.db-wal
stats2.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
cache4.db-journal
cache4.db-wal
stats2.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
cache4.db-journal
cache4.db-wal
stats2.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
bluebubbles.attheme
cache4.db
cache4.db-journal
cache4.db-shm
cache4.db-wal
dc2conf.dat
remote_en.xml
stats2.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
com.google.android.maps.jar
000000000_999999_temp.f