{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/tasks.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/pithus.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/virus_total.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/modules/malware_bazaar.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/management/commands/upload_to_mb.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/bazaar/core/services/apk.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/local.yml", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/requirements/base.txt", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/config/settings/base.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/compose/local/django/Dockerfile", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/.github/workflows/ci.yml", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/tests/conftest.py", "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/LICENSE", "https://github.com/Pithus/bazaar/releases/tag/v1.0.1-beta", "https://github.com/Pithus/bazaar/releases/tag/v1.0.0-beta" ], "category": "android", "description_en": "Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.", "description_zh": "Pithus Android 应用分析服务背后的可自托管 Django 平台，README 称其面向活动人士、记者、非政府组织和研究人员。上传的 APK 以 SHA-256 为名保存，并排队执行多项静态分析：用 Androguard 提取属性与类，用 APKiD 识别编译器与加壳工具，用 ssdeep 和 Dexofuzzy 计算相似度，用 Quark-Engine 规则识别行为，用 androcfg 生成调用图，匹配 Exodus 跟踪器特征，生成 MobSF 静态报告，读取 APK 签名块元数据，并运行分析者编写的 YARA 规则，还可对已存样本进行回溯检索。结果写入 Elasticsearch，以网页报告和 REST API 呈现，并可选用 MalwareBazaar、VirusTotal、MISP 和 Google Play 查询补充信息。", "entry_url": "https://awesomerea.org/resources/pithus-bazaar/", "entry_url_zh": "https://awesomerea.org/zh/resources/pithus-bazaar/", "evidence_url": "https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/README.md", "group": "tools", "id": "pithus-bazaar", "json_url": "https://awesomerea.org/resources/pithus-bazaar/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/pithus-bazaar/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/pithus-bazaar/index.md", "name": "Pithus (bazaar)", "name_zh": "Pithus（bazaar）Android 应用分析平台", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v1.0.1-beta, published 2026-10-12, a bug-fix and dependency update to v1.0.0-beta of 2026-09-21. That release upgraded the 2021 code base, rewrote the API with a separate Python client and is not compatible with earlier Pithus data; its notes say import documentation will follow. The reviewed master commit, from 2026-10-16, is 27 commits later and adds a MISP connector. A hosted beta runs at beta.pithus.org.", "The README documents a Linux development stack started with docker-compose -f local.yml and served at localhost:8001, and warns that a missing-index error may appear on first load. The stack runs a Python 3.13 Django 6 app with a django-q worker, PostgreSQL, Redis, Elasticsearch and Kibana 8.19 with a 2 GB Elasticsearch heap, MobSF v4.5.3, RustFS S3-compatible storage and Prometheus; separate compose files cover Apple M1, staging and production.", "Input is an APK uploaded through the web interface or API, or fetched from a URL. VirusTotal and MalwareBazaar lookups send the sample's SHA-256 to those services with configured API keys, MISP matching needs a MISP URL and key, Google Play metadata is scraped by package name, tracker signatures are downloaded from Exodus Privacy at analysis time, and an upload_to_mb management command uploads stored samples to MalwareBazaar when an operator runs it.", "The analysis tasks are static or lookup-based; no dynamic or sandboxed execution is part of the pipeline, and rule, similarity and reputation results are indicators. The pytest suite mocks Elasticsearch and storage and uses tests/_data/test.apk, a project-built sample app with the package com.pithus.basicapp. The CI pytest job is commented out, so CI lints, runs bandit and builds and pushes Docker images. Quark-Engine is installed from a fork, and quark-rules holds 280 rule files.", "AGPL-3.0; the bundled front-end libraries and the analyzers it calls, including MobSF, keep their own licenses." ], "requirements_zh": [ "审阅时最新版本为 v1.0.1-beta，发布于 2026-10-12，是对 2026-09-21 发布的 v1.0.0-beta 的缺陷修复与依赖更新。v1.0.0-beta 升级了 2021 年的旧代码库，重写了 API 并另行提供 Python 客户端，且与早期 Pithus 数据不兼容；其发布说明称导入文档将在日后提供。所审阅的 master 提交日期为 2026-10-16，比该版本多 27 个提交，新增了 MISP 连接器。托管的测试版服务位于 beta.pithus.org。", "README 说明的是在 Linux 上用 docker-compose -f local.yml 启动的开发环境，服务地址为 localhost:8001，并提醒首次打开时可能出现缺少索引的错误。该环境运行基于 Python 3.13 和 Django 6 的应用及 django-q 工作进程，以及 PostgreSQL、Redis、Elasticsearch 和 Kibana 8.19（Elasticsearch 堆内存设为 2 GB）、MobSF v4.5.3、兼容 S3 的 RustFS 存储和 Prometheus；另有用于 Apple M1、预发布和生产环境的 compose 文件。", "输入为通过网页界面或 API 上传的 APK，也可从 URL 获取。VirusTotal 与 MalwareBazaar 查询会使用已配置的 API 密钥，把样本的 SHA-256 发送给这些服务；MISP 匹配需要 MISP 地址和密钥；Google Play 元数据按包名抓取；跟踪器特征在分析时从 Exodus Privacy 下载；运维人员运行 upload_to_mb 管理命令时，会把已存样本上传到 MalwareBazaar。", "分析任务均为静态分析或外部查询，流程中没有动态执行或沙箱运行；规则、相似度和信誉服务的结果只是迹象。pytest 测试模拟了 Elasticsearch 和存储，并使用 tests/_data/test.apk，这是项目自行构建、包名为 com.pithus.basicapp 的示例应用。CI 中的 pytest 任务已被注释掉，因此 CI 只做代码检查、运行 bandit，并构建和推送 Docker 镜像。Quark-Engine 从一个分支仓库安装，quark-rules 目录收录 280 个规则文件。", "采用 AGPL-3.0 许可；随附的前端库及其调用的分析工具（包括 MobSF）各自保留其许可证。" ], "targets": [ "app" ], "url": "https://github.com/Pithus/bazaar", "verification": "source-reviewed", "verified_at": "2026-10-20" }