Tool

Pithus (bazaar)

Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.

Targets: App
Category: Android tools
Relationship: Foundation tool
Sources reviewed: 2026-10-20

Requirements & limits

Latest release at review: v1.0.1-beta, published 2026-10-12, a bug-fix and dependency update to v1.0.0-beta of 2026-09-21. That release upgraded the 2021 code base, rewrote the API with a separate Python client and is not compatible with earlier Pithus data; its notes say import documentation will follow. The reviewed master commit, from 2026-10-16, is 27 commits later and adds a MISP connector. A hosted beta runs at beta.pithus.org.
The README documents a Linux development stack started with docker-compose -f local.yml and served at localhost:8001, and warns that a missing-index error may appear on first load. The stack runs a Python 3.13 Django 6 app with a django-q worker, PostgreSQL, Redis, Elasticsearch and Kibana 8.19 with a 2 GB Elasticsearch heap, MobSF v4.5.3, RustFS S3-compatible storage and Prometheus; separate compose files cover Apple M1, staging and production.
Input is an APK uploaded through the web interface or API, or fetched from a URL. VirusTotal and MalwareBazaar lookups send the sample's SHA-256 to those services with configured API keys, MISP matching needs a MISP URL and key, Google Play metadata is scraped by package name, tracker signatures are downloaded from Exodus Privacy at analysis time, and an upload_to_mb management command uploads stored samples to MalwareBazaar when an operator runs it.
The analysis tasks are static or lookup-based; no dynamic or sandboxed execution is part of the pipeline, and rule, similarity and reputation results are indicators. The pytest suite mocks Elasticsearch and storage and uses tests/_data/test.apk, a project-built sample app with the package com.pithus.basicapp. The CI pytest job is commented out, so CI lints, runs bandit and builds and pushes Docker images. Quark-Engine is installed from a fork, and quark-rules holds 280 rule files.
AGPL-3.0; the bundled front-end libraries and the analyzers it calls, including MobSF, keep their own licenses.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/tasks.py GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/modules/pithus.py GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/modules/virus_total.py GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/modules/malware_bazaar.py GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/management/commands/upload_to_mb.py GitHub · Pithus/bazaar · Revision 3217f72
bazaar/core/services/apk.py GitHub · Pithus/bazaar · Revision 3217f72
local.yml GitHub · Pithus/bazaar · Revision 3217f72
requirements/base.txt GitHub · Pithus/bazaar · Revision 3217f72
config/settings/base.py GitHub · Pithus/bazaar · Revision 3217f72
compose/local/django/Dockerfile GitHub · Pithus/bazaar · Revision 3217f72
.github/workflows/ci.yml GitHub · Pithus/bazaar · Revision 3217f72
tests/conftest.py GitHub · Pithus/bazaar · Revision 3217f72
LICENSE GitHub · Pithus/bazaar · Revision 3217f72
https://github.com/Pithus/bazaar/releases/tag/v1.0.1-beta
https://github.com/Pithus/bazaar/releases/tag/v1.0.0-beta

Requirements & limits

About this entry

Primary sources

More in Apps