AwesomeREA.org

Tool

Pithus (bazaar)

Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.

Requirements & limits

  • Latest release at review: v1.0.1-beta, published 2026-10-12, a bug-fix and dependency update to v1.0.0-beta of 2026-09-21. That release upgraded the 2021 code base, rewrote the API with a separate Python client and is not compatible with earlier Pithus data; its notes say import documentation will follow. The reviewed master commit, from 2026-10-16, is 27 commits later and adds a MISP connector. A hosted beta runs at beta.pithus.org.
  • The README documents a Linux development stack started with docker-compose -f local.yml and served at localhost:8001, and warns that a missing-index error may appear on first load. The stack runs a Python 3.13 Django 6 app with a django-q worker, PostgreSQL, Redis, Elasticsearch and Kibana 8.19 with a 2 GB Elasticsearch heap, MobSF v4.5.3, RustFS S3-compatible storage and Prometheus; separate compose files cover Apple M1, staging and production.
  • Input is an APK uploaded through the web interface or API, or fetched from a URL. VirusTotal and MalwareBazaar lookups send the sample's SHA-256 to those services with configured API keys, MISP matching needs a MISP URL and key, Google Play metadata is scraped by package name, tracker signatures are downloaded from Exodus Privacy at analysis time, and an upload_to_mb management command uploads stored samples to MalwareBazaar when an operator runs it.
  • The reviewed analysis tasks are static or lookup-based; no dynamic or sandboxed execution is part of the pipeline, and rule, similarity and reputation results are indicators for an analyst to review. The pytest suite mocks Elasticsearch and storage and uses tests/_data/test.apk, a project-built sample app with the package com.pithus.basicapp. The CI pytest job is commented out, so CI lints, runs bandit and builds and pushes Docker images. Quark-Engine is installed from a fork, and quark-rules holds 280 rule files.
  • AGPL-3.0; the bundled front-end libraries and the analyzers it calls, including MobSF, keep their own licenses. The reviewed sources state no REA use, and this collection deployed nothing and analyzed no samples.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Pithus/bazaar · Revision 3217f72
  2. bazaar/core/tasks.py GitHub · Pithus/bazaar · Revision 3217f72
  3. bazaar/core/modules/pithus.py GitHub · Pithus/bazaar · Revision 3217f72
  4. bazaar/core/modules/virus_total.py GitHub · Pithus/bazaar · Revision 3217f72
  5. bazaar/core/modules/malware_bazaar.py GitHub · Pithus/bazaar · Revision 3217f72
  6. bazaar/core/management/commands/upload_to_mb.py GitHub · Pithus/bazaar · Revision 3217f72
  7. bazaar/core/services/apk.py GitHub · Pithus/bazaar · Revision 3217f72
  8. local.yml GitHub · Pithus/bazaar · Revision 3217f72
  9. requirements/base.txt GitHub · Pithus/bazaar · Revision 3217f72
  10. config/settings/base.py GitHub · Pithus/bazaar · Revision 3217f72
  11. compose/local/django/Dockerfile GitHub · Pithus/bazaar · Revision 3217f72
  12. .github/workflows/ci.yml GitHub · Pithus/bazaar · Revision 3217f72
  13. tests/conftest.py GitHub · Pithus/bazaar · Revision 3217f72
  14. LICENSE GitHub · Pithus/bazaar · Revision 3217f72
  15. https://github.com/Pithus/bazaar/releases/tag/v1.0.1-beta
  16. https://github.com/Pithus/bazaar/releases/tag/v1.0.0-beta

More in Apps

All 113 entries in Apps