769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf

Analysis

max time kernel
11s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
01-01-2025 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base_113.apk
Size

53.0MB
MD5

85ed51b00887d331b476f9568222743c
SHA1

fba6938bd6a675b21b4d77d49a58e7fc0b8f9e4d
SHA256

769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf
SHA512

e097b553c7682849580c0841f89e7141f92a1c2c6e6252496c3e61f504c1e7522953ffb9a61cb129f14100e4e6d39433f7a2c21a3596029422b1c5d27a6c962a
SSDEEP

786432:phP09KrszNOTCzZSs1LllhySA2yFy5msUonUdnp5ZxQ56OcpvcZbE33bHeVjKek7:f09Kgzacht85sXU0DcpvkEnoYcxiJ

Score

8^/10

discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.makemytrip
/system/app/Superuser.apk	com.makemytrip

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4660	com.makemytrip
/system_ext/framework/androidx.window.sidecar.jar	4660	com.makemytrip
/system_ext/framework/androidx.window.sidecar.jar	4769	com.makemytrip:playcore_missing_splits_activity
/system_ext/framework/androidx.window.sidecar.jar	4769	com.makemytrip:playcore_missing_splits_activity

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.makemytrip

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.makemytrip

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.makemytrip

Checks the presence of a debugger
evasion

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.makemytrip

com.makemytrip
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Checks memory information
PID:4660

com.makemytrip:playcore_missing_splits_activity
1⤵
- Loads dropped Dex/Jar
PID:4769

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.makemytrip/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
45cf6357580c2452465f916ec66e3aab

SHA1
876bfe8b9a738450c0379667436fb11b28ab6d32

SHA256
bf69d5a5e1b41f512eb3ff220f436915928cea3fb62a0a98da2c15188c8a8923

SHA512
9834832b170a5873e4d38e16bd71c732e84cdac9fb69b0e6c1c1408f6dd26ea50a5539109248c34d105cceefd776a880c62efd5db691b4370d0b661d028fac0a

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
e867aed6b3ca3f6881bca6c58223bbed

SHA1
1327bfb8e0740bdf198a3ad4134425e3d4aa9b3c

SHA256
05d4b904c1346fec4c193ba8659ff09f67a538021ab5523d9b7ed9cc4088a45c

SHA512
55fdb34d0101b495662669517f3c8487fe886ca362a952e37c7f96e5baed9055e7bb701cbb1a92900464ac402f8da95ac56046d8257ac9c3bfb90c6056d0f991

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
fd93bd15fd2965f6aa8f422bb3244230

SHA1
eab3f93b49e3fc6b6a95c41ed4abf1632ebdac8b

SHA256
88803089730f4096439c90dc5ab3d8c05a02b4520850acf8a00f9bdc25bd5531

SHA512
de791db0a081b29dcfa19e7f62d078462495cd7d09f0a23683f561014d13578fa561a2f831ce8ffbf798a9d1fb7fda353a1742d5eb7c37641f0fe810a58f5682

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
7a1d36dc6857032aea8254c33d12db59

SHA1
56b841baa016df91a008705f2c1a1c57be2dc3ea

SHA256
4964b115a38df0f9f7d9c968789b2adaf4adabc12f879ea947f74ae5985c34c0

SHA512
28dbfbcc8aabf2cafe731cc8427e7891619739185c8bab258b737cf80fe5f4266d33ff6ca68fd82748062f62ce34825b0fbd07fd2529e4d2f0d21b0481ebee59

Download Submit
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/com.crashlytics.settings.json

Filesize
710B

MD5
288238cd88bc4667f8c4c554b172393d

SHA1
81faf54cdb524202c8f8e586fcfd617d460d0b47

SHA256
e08bb20e9bcc0c204590fbda3164b514409003069a2033b303738cff328079a1

SHA512
71c6371595934f2f5961186c67e29c45437dbfc7a25fcc65ca60970b1819b977d0b3eb7ecd35039685b9016e5bccc72b28cadca08309c0e1b27ac173e8bc65f7

Download Submit
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/open-sessions/67751915031C00011234893C3494ABB7/report

Filesize
736B

MD5
af92c38e6226afbf4256485cf6039a38

SHA1
128ab49233a7f3c9c2fe9000359ace2a4c41c5d8

SHA256
814362bddc438e5a3e2ac3f970eebfd1b5a15e23042effa9f793ffa39142704c

SHA512
44384e43b822e344cc2f4ab17c729cb8f207c0268239652296a563d322df5cf70396028590f6a12998f9de87228fb6371b5e4d5eb8e1c1a9fc5d4e96e7d4c981

Download Submit
/data/data/com.makemytrip/files/PersistedInstallation116375921542599314tmp

Filesize
560B

MD5
07bb07d393df79be4e0924a2eb2ca21d

SHA1
e3ff1d66a2764e148411fed5f5a1fd5886ff56d9

SHA256
fb6d39b22fdd5b58792806eed04c082ccb5338923d03282e5489b03f5cf3b74f

SHA512
f3908c7a9ce31ef9e60c9e8b1f5b8a989af8ef62dd2c473fbf9696a345614854859cef2e74f8d1753c2218d3918ffba015cc6e2c18ddaef40a6df4aabd411cf3

Download Submit
/data/data/com.makemytrip/files/PersistedInstallation8432757778432828772tmp

Filesize
90B

MD5
aa3c31886400298496719420a744be06

SHA1
cab953561f6688af2eed3c8f1db5aba8a54f4f30

SHA256
c6a1c186570d25aace01db97305e17a0196346f82ad0d81e8189870e767a96f0

SHA512
c1a8f6eb17f88368581dabb3f6140100d318c68014071446cf0d687f430f1f0873e23ac78a3199853383665427e3d2dd73105dcfa9fc5fa406c5b832767fe84d

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ac134b1cde1e2dde016ef7b4a66288f4

SHA1
68e66df4c9f7ccac56168500b0a3491b515d2c14

SHA256
c13e876a7675f900debb0f454125f117ec281effdaf84b530ebe3585fb7bf06c

SHA512
e9419a2a842673f660c480fa40f2317bf922efddcc7cc82210caced337ef43425aa4f02602f2015c73def7ce7210b7dce619339c6178c41950fa6eba1ead7195

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
bd8a7301d67071fe6c87aad9a5e3c2f6

SHA1
67d3d355cbd79d27961d1bb8aacb19713f8ce324

SHA256
c1ac118e7655db4ca94cf5ff0d042cf135110db5ac3eea8bffadb7232dbb09fc

SHA512
9ee1107163d5a69d30b1418b60b68e56f8b3557d54745eba251afe8cdc8dfbbcb615e5d0197398cb88b157f09fd12592a05976fe7e05f35e5067f7a1ec6113c4

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
78417a796d004319eeaddf22d216e376

SHA1
e6b1800011133503ef2379d7932b358a159171cf

SHA256
d0949ca6590990f6a435847f42656ebf7f74d6ee95db9cba980e5508c3735eec

SHA512
ab9d6587c554d5e5f9b3c68f86351c03e4c2e9b26057ac0dd6192cd8775c34402247dc10ff9e013ccd129bafbf232cc697863283cd339bef6a9bf300fdd148c8

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads