Analysis
-
max time kernel
10s -
max time network
168s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
02/01/2025, 02:17
Behavioral task
behavioral1
Sample
769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk
Resource
android-x64-20240624-en
General
-
Target
769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk
-
Size
53.0MB
-
MD5
85ed51b00887d331b476f9568222743c
-
SHA1
fba6938bd6a675b21b4d77d49a58e7fc0b8f9e4d
-
SHA256
769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf
-
SHA512
e097b553c7682849580c0841f89e7141f92a1c2c6e6252496c3e61f504c1e7522953ffb9a61cb129f14100e4e6d39433f7a2c21a3596029422b1c5d27a6c962a
-
SSDEEP
786432:phP09KrszNOTCzZSs1LllhySA2yFy5msUonUdnp5ZxQ56OcpvcZbE33bHeVjKek7:f09Kgzacht85sXU0DcpvkEnoYcxiJ
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.makemytrip /system/xbin/su com.makemytrip -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.makemytrip -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.makemytrip -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.makemytrip -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.makemytrip:playcore_missing_splits_activity Framework service call android.app.IActivityManager.registerReceiver com.makemytrip -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.makemytrip
Processes
-
com.makemytrip1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5101
-
com.makemytrip:playcore_missing_splits_activity1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5206
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD53c40fa54b03e1a0028bcd90f80962dec
SHA17462a6a6f70647ac3a534ddd09c5236b05d887ee
SHA256b7fb00e4fd5614b4820b6d2e183d626e697e866b5758cec46480dae8164724ce
SHA5129c63aac5e7e2650b6f8ceacde2719fe05bb6a6cf8003e644741baf823da6b5744f77a3f356ee7027572cd882752d9cc1c2d94ecd28d3e334c1037874d03e1a95
-
Filesize
512B
MD56a05f98f61c57c4c38c0e677ec483bb8
SHA1eb3e83511acdebd90c4846bef9cce8072238e195
SHA256db78d832269ff1d66f97dda76734f07384f877bef4f6563fd641c6536d42331e
SHA512f1daf4267f471e98e124d1b6991cee019081766be5dce7942bf0f36d4dc9d39947e3d3863b10f9a2ce4b1703729b3ddfcc6ee12f820cce1e7466d838bb33a199
-
Filesize
8KB
MD5177bfaa3b650bf52854a3a8506371541
SHA164af18d3252150f18d9d34c3ad8bbc6c1e404f81
SHA25600ebde35a895c1ccedfa56a7c49144605c83f839dad9e1bb991f15016e294e2e
SHA512632fffd0575be245628944a98e0b24c3e36d4142c55db1a040133bb395d80ea6f49d364e533d58f0c0f5221dda1f27c700bec67e196eb52b11e2ba0fc7382027
-
Filesize
8KB
MD5536b2e945f3fb48dc80500b59cb2b65b
SHA1000b7abb55606b774f21ba7c9dddf26d58626bf0
SHA25628e5eb6eb107fc4f08c40f29dd89919405c52718430485fc23939bde9b51e71d
SHA51247d5925249d5dbbcff46d0f9af85d4bf59b113a7839fa43989392f6b8a51405ab2c90cda1ba6f5f890c69a127cc3cf92e95a0d5b988b98393ffdba8ee9042794
-
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/com.crashlytics.settings.json
Filesize710B
MD54cebdea2f0c4daca6f8cf3026f307aec
SHA180e8b93c57bded430629a9d6ef9cb45d0cfb688c
SHA25614254b0682dd63bec394dfd35b77c08e27a22956c577f8d300e39e05150a5c02
SHA5129fd48ba6ee9ee7efacd7adc4c812594a80d3d977115b1d35f293cceadd30f50f855eb6f0f9572712310aa16f175b9c1d3e832c6528c1d5cace070107d105848e
-
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/open-sessions/6775F75503D3000113ED97C3E6433A08/report
Filesize736B
MD5d85f4fafde29f9cbd27c5a308556a0ba
SHA1d4950ee55ddcb196b07d38286a1e07f31843926c
SHA2560f180e553572d725179c174aad32284ac946e9c4892bd99d7cfb294628a93a12
SHA5126ce023bc19542c3a4dc3d633c3011b0700a76159c23f34b8393170aacad757c637b739c862c818ffa9fb6737b5a3dd3824687ff6a9d5d3c3b328ad3714dda263
-
Filesize
90B
MD58cb166d3b79f54ea70724d9cc4571dd4
SHA11427fc02122bd4a77428db899ee2562c20ce4804
SHA256c236bea361f28c9dd19bd0063255c3b069e58e22c25e6d5e3e6c06b632b25fb4
SHA512f6c877ca17ae5f0a6476ab6029236f8ef5e41d76c6f04709ed589223555feed2e1ca30d027ea57762cbb3a20e74732c52b75820effc6d758fa01749af0371ab2
-
Filesize
561B
MD555cec0c7709b40c8685dd40075e05178
SHA1a4ab4b5c73a61be1e8da774f803d6acff4e483a9
SHA256f70ef721cdb750b64f66f459d92dfc13363696458349ac6f34ed7087ec7885ab
SHA512bc52ca17c95215a29959c65f561d9d9843d7972a81c5fb47d745877d088fca58ccfb153d7a5349a70eed0766bef862dbc24fc0da04a740ce248e2f81c2fb7b51
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5765644870cbe6d26bd623fc90478f910
SHA17f541979500edda1db1d4ad382a4926a632b3ad7
SHA256c83808221a1164a91b0b966850e3be49d9d10f0a550aadc9498f1a27fff675ab
SHA5128e501b5a359c05f590ad6bdb6ab07990f34205a96a020b4687c13380b4b314f1512c9214f1001b9515f313a8e124a747b359aee2882d20f785104322717e50b4
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5a5e5aec9a28ad12b824aa0852c85339f
SHA17ba6f1e641f19cee11fc6e080b90c7bd9d116a07
SHA25602ea6af8ca65c5395f010bf16ae6440000e519cfc29833b0ed10184d51fa6140
SHA51239431d538f6d52c369c9fa8121d90b2b8910c092aebc087bdd568dd9f8a903fa044437462c72602bdb851a796313f500b77fccc17af0056bd3be409dbca86998
-
Filesize
92KB
MD5aded8bb93b712ce0dbd7de4661e33302
SHA11f5c603a440c58a9824dbb7cdcfe25e565b45f0f
SHA2560b6431d1adea0245bc74acd6684591e77814feeca781b463a124904d7dbc47a4
SHA512dd3f02ff1166bd571a0cd33c5b24d73ab248746ed43d35bb944817dcbf28860ac13ce785b6f6836ba87598ffaf23c45a86118026c4b15cccdad1160778c66819