Trusted Design

BusyGasper – the unfriendly spy

概要

In early 2018 our mobile intruder-detection technology was triggered by a suspicious Android sample that, as it turned out, belonged to an unknown spyware family. Further investigation showed that the malware, which we named BusyGasper, is not all that sophisticated, but demonstrates some unusual features for this type of threat. From a technical point of view, the sample is a unique spy implant with stand-out features such as device sensors listeners, including motion detectors that have been implemented with a degree of originality. It has an incredibly wide-ranging protocol – about 100 commands – and an ability to bypass the Doze battery saver. As a modern Android spyware it is also capable of exfiltrating data from messaging applications (WhatsApp, Viber, Facebook). Moreover, BusyGasper boasts some keylogging tools – the malware processes every user tap, gathering its coordinates and calculating characters by matching given values with hardcoded ones.

Created: 2026-02-23

Indicators

• FileHash-MD5 - 6c246bbb40b7c6e75c60a55c0da9e2f2 -
• FileHash-MD5 - 9e005144ea1a583531f86663a5f14607 -
• FileHash-MD5 - bde7847487125084f9e03f2b6b05adc3 -
• FileHash-MD5 - 7c8a12e56e3e03938788b26b84b80bd6 -
• FileHash-MD5 - 9ffc350ef94ef840728564846f2802b0 -
• FileHash-MD5 - 18abe28730c53de6d9e4786c7765c3d8 -
• FileHash-MD5 - 2560942bb50ee6e6f55afc495d238a12 -

類似Pulses

• Ratcheting Down on JSocket: A PC and Android Threat (score: 0.66)
• Skygofree: Following in the footsteps of HackingTeam (score: 0.64)
• Triout Android Spyware Framework Makes a Comeback, Abusing App with 50 Million Downloads (score: 0.60)
• New Android "Ghost Push" Variants (score: 0.60)
• HummingBad: A Persistent Mobile Chain Attack (score: 0.58)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る