# Pithus (bazaar)

> Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.

- Type: Tool
- Targets: App
- Category: Android tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/Pithus/bazaar>
- Primary source: <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/README.md>
- Catalog page: <https://awesomerea.org/resources/pithus-bazaar/>
- Record JSON: <https://awesomerea.org/resources/pithus-bazaar/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/pithus-bazaar/index.md)

## Requirements & limits

- Latest release at review: v1.0.1-beta, published 2026-10-12, a bug-fix and dependency update to v1.0.0-beta of 2026-09-21. That release upgraded the 2021 code base, rewrote the API with a separate Python client and is not compatible with earlier Pithus data; its notes say import documentation will follow. The reviewed master commit, from 2026-10-16, is 27 commits later and adds a MISP connector. A hosted beta runs at beta.pithus.org.
- The README documents a Linux development stack started with docker-compose -f local.yml and served at localhost:8001, and warns that a missing-index error may appear on first load. The stack runs a Python 3.13 Django 6 app with a django-q worker, PostgreSQL, Redis, Elasticsearch and Kibana 8.19 with a 2 GB Elasticsearch heap, MobSF v4.5.3, RustFS S3-compatible storage and Prometheus; separate compose files cover Apple M1, staging and production.
- Input is an APK uploaded through the web interface or API, or fetched from a URL. VirusTotal and MalwareBazaar lookups send the sample's SHA-256 to those services with configured API keys, MISP matching needs a MISP URL and key, Google Play metadata is scraped by package name, tracker signatures are downloaded from Exodus Privacy at analysis time, and an upload_to_mb management command uploads stored samples to MalwareBazaar when an operator runs it.
- The analysis tasks are static or lookup-based; no dynamic or sandboxed execution is part of the pipeline, and rule, similarity and reputation results are indicators. The pytest suite mocks Elasticsearch and storage and uses tests/_data/test.apk, a project-built sample app with the package com.pithus.basicapp. The CI pytest job is commented out, so CI lints, runs bandit and builds and pushes Docker images. Quark-Engine is installed from a fork, and quark-rules holds 280 rule files.
- AGPL-3.0; the bundled front-end libraries and the analyzers it calls, including MobSF, keep their own licenses.

## Primary sources

1. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/README.md>
2. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/tasks.py>
3. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/pithus.py>
4. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/virus_total.py>
5. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/malware_bazaar.py>
6. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/management/commands/upload_to_mb.py>
7. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/services/apk.py>
8. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/local.yml>
9. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/requirements/base.txt>
10. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/config/settings/base.py>
11. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/compose/local/django/Dockerfile>
12. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/.github/workflows/ci.yml>
13. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/tests/conftest.py>
14. <https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/LICENSE>
15. <https://github.com/Pithus/bazaar/releases/tag/v1.0.1-beta>
16. <https://github.com/Pithus/bazaar/releases/tag/v1.0.0-beta>

## More in Apps

- [House](https://awesomerea.org/resources/house/index.md) · Tool
- [ABCDE](https://awesomerea.org/resources/abcde/index.md) · Tool
- [de4js](https://awesomerea.org/resources/de4js/index.md) · Tool
- [DexKit](https://awesomerea.org/resources/dexkit/index.md) · Tool
- [bun-demincer](https://awesomerea.org/resources/bun-demincer/index.md) · Tool
- [dex-oracle](https://awesomerea.org/resources/dex-oracle/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.