Analysis

  • max time kernel
    10s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    02/01/2025, 02:17

General

  • Target

    769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk

  • Size

    53.0MB

  • MD5

    85ed51b00887d331b476f9568222743c

  • SHA1

    fba6938bd6a675b21b4d77d49a58e7fc0b8f9e4d

  • SHA256

    769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf

  • SHA512

    e097b553c7682849580c0841f89e7141f92a1c2c6e6252496c3e61f504c1e7522953ffb9a61cb129f14100e4e6d39433f7a2c21a3596029422b1c5d27a6c962a

  • SSDEEP

    786432:phP09KrszNOTCzZSs1LllhySA2yFy5msUonUdnp5ZxQ56OcpvcZbE33bHeVjKek7:f09Kgzacht85sXU0DcpvkEnoYcxiJ

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.makemytrip
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5101
  • com.makemytrip:playcore_missing_splits_activity
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5206

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.makemytrip/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    3c40fa54b03e1a0028bcd90f80962dec

    SHA1

    7462a6a6f70647ac3a534ddd09c5236b05d887ee

    SHA256

    b7fb00e4fd5614b4820b6d2e183d626e697e866b5758cec46480dae8164724ce

    SHA512

    9c63aac5e7e2650b6f8ceacde2719fe05bb6a6cf8003e644741baf823da6b5744f77a3f356ee7027572cd882752d9cc1c2d94ecd28d3e334c1037874d03e1a95

  • /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    6a05f98f61c57c4c38c0e677ec483bb8

    SHA1

    eb3e83511acdebd90c4846bef9cce8072238e195

    SHA256

    db78d832269ff1d66f97dda76734f07384f877bef4f6563fd641c6536d42331e

    SHA512

    f1daf4267f471e98e124d1b6991cee019081766be5dce7942bf0f36d4dc9d39947e3d3863b10f9a2ce4b1703729b3ddfcc6ee12f820cce1e7466d838bb33a199

  • /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    177bfaa3b650bf52854a3a8506371541

    SHA1

    64af18d3252150f18d9d34c3ad8bbc6c1e404f81

    SHA256

    00ebde35a895c1ccedfa56a7c49144605c83f839dad9e1bb991f15016e294e2e

    SHA512

    632fffd0575be245628944a98e0b24c3e36d4142c55db1a040133bb395d80ea6f49d364e533d58f0c0f5221dda1f27c700bec67e196eb52b11e2ba0fc7382027

  • /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    536b2e945f3fb48dc80500b59cb2b65b

    SHA1

    000b7abb55606b774f21ba7c9dddf26d58626bf0

    SHA256

    28e5eb6eb107fc4f08c40f29dd89919405c52718430485fc23939bde9b51e71d

    SHA512

    47d5925249d5dbbcff46d0f9af85d4bf59b113a7839fa43989392f6b8a51405ab2c90cda1ba6f5f890c69a127cc3cf92e95a0d5b988b98393ffdba8ee9042794

  • /data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/com.crashlytics.settings.json

    Filesize

    710B

    MD5

    4cebdea2f0c4daca6f8cf3026f307aec

    SHA1

    80e8b93c57bded430629a9d6ef9cb45d0cfb688c

    SHA256

    14254b0682dd63bec394dfd35b77c08e27a22956c577f8d300e39e05150a5c02

    SHA512

    9fd48ba6ee9ee7efacd7adc4c812594a80d3d977115b1d35f293cceadd30f50f855eb6f0f9572712310aa16f175b9c1d3e832c6528c1d5cace070107d105848e

  • /data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/open-sessions/6775F75503D3000113ED97C3E6433A08/report

    Filesize

    736B

    MD5

    d85f4fafde29f9cbd27c5a308556a0ba

    SHA1

    d4950ee55ddcb196b07d38286a1e07f31843926c

    SHA256

    0f180e553572d725179c174aad32284ac946e9c4892bd99d7cfb294628a93a12

    SHA512

    6ce023bc19542c3a4dc3d633c3011b0700a76159c23f34b8393170aacad757c637b739c862c818ffa9fb6737b5a3dd3824687ff6a9d5d3c3b328ad3714dda263

  • /data/data/com.makemytrip/files/PersistedInstallation4778157777058507952tmp

    Filesize

    90B

    MD5

    8cb166d3b79f54ea70724d9cc4571dd4

    SHA1

    1427fc02122bd4a77428db899ee2562c20ce4804

    SHA256

    c236bea361f28c9dd19bd0063255c3b069e58e22c25e6d5e3e6c06b632b25fb4

    SHA512

    f6c877ca17ae5f0a6476ab6029236f8ef5e41d76c6f04709ed589223555feed2e1ca30d027ea57762cbb3a20e74732c52b75820effc6d758fa01749af0371ab2

  • /data/data/com.makemytrip/files/PersistedInstallation938480636491852148tmp

    Filesize

    561B

    MD5

    55cec0c7709b40c8685dd40075e05178

    SHA1

    a4ab4b5c73a61be1e8da774f803d6acff4e483a9

    SHA256

    f70ef721cdb750b64f66f459d92dfc13363696458349ac6f34ed7087ec7885ab

    SHA512

    bc52ca17c95215a29959c65f561d9d9843d7972a81c5fb47d745877d088fca58ccfb153d7a5349a70eed0766bef862dbc24fc0da04a740ce248e2f81c2fb7b51

  • /data/data/com.makemytrip/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.makemytrip/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    765644870cbe6d26bd623fc90478f910

    SHA1

    7f541979500edda1db1d4ad382a4926a632b3ad7

    SHA256

    c83808221a1164a91b0b966850e3be49d9d10f0a550aadc9498f1a27fff675ab

    SHA512

    8e501b5a359c05f590ad6bdb6ab07990f34205a96a020b4687c13380b4b314f1512c9214f1001b9515f313a8e124a747b359aee2882d20f785104322717e50b4

  • /data/data/com.makemytrip/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    a5e5aec9a28ad12b824aa0852c85339f

    SHA1

    7ba6f1e641f19cee11fc6e080b90c7bd9d116a07

    SHA256

    02ea6af8ca65c5395f010bf16ae6440000e519cfc29833b0ed10184d51fa6140

    SHA512

    39431d538f6d52c369c9fa8121d90b2b8910c092aebc087bdd568dd9f8a903fa044437462c72602bdb851a796313f500b77fccc17af0056bd3be409dbca86998

  • /data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

    Filesize

    92KB

    MD5

    aded8bb93b712ce0dbd7de4661e33302

    SHA1

    1f5c603a440c58a9824dbb7cdcfe25e565b45f0f

    SHA256

    0b6431d1adea0245bc74acd6684591e77814feeca781b463a124904d7dbc47a4

    SHA512

    dd3f02ff1166bd571a0cd33c5b24d73ab248746ed43d35bb944817dcbf28860ac13ce785b6f6836ba87598ffaf23c45a86118026c4b15cccdad1160778c66819