769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf

Analysis

max time kernel
10s
max time network
168s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
02/01/2025, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk
Size

53.0MB
MD5

85ed51b00887d331b476f9568222743c
SHA1

fba6938bd6a675b21b4d77d49a58e7fc0b8f9e4d
SHA256

769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf
SHA512

e097b553c7682849580c0841f89e7141f92a1c2c6e6252496c3e61f504c1e7522953ffb9a61cb129f14100e4e6d39433f7a2c21a3596029422b1c5d27a6c962a
SSDEEP

786432:phP09KrszNOTCzZSs1LllhySA2yFy5msUonUdnp5ZxQ56OcpvcZbE33bHeVjKek7:f09Kgzacht85sXU0DcpvkEnoYcxiJ

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.makemytrip
/system/xbin/su	com.makemytrip

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.makemytrip

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.makemytrip

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.makemytrip

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.makemytrip:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.registerReceiver	com.makemytrip

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.makemytrip

com.makemytrip
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5101

com.makemytrip:playcore_missing_splits_activity
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5206

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.makemytrip/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
3c40fa54b03e1a0028bcd90f80962dec

SHA1
7462a6a6f70647ac3a534ddd09c5236b05d887ee

SHA256
b7fb00e4fd5614b4820b6d2e183d626e697e866b5758cec46480dae8164724ce

SHA512
9c63aac5e7e2650b6f8ceacde2719fe05bb6a6cf8003e644741baf823da6b5744f77a3f356ee7027572cd882752d9cc1c2d94ecd28d3e334c1037874d03e1a95

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
6a05f98f61c57c4c38c0e677ec483bb8

SHA1
eb3e83511acdebd90c4846bef9cce8072238e195

SHA256
db78d832269ff1d66f97dda76734f07384f877bef4f6563fd641c6536d42331e

SHA512
f1daf4267f471e98e124d1b6991cee019081766be5dce7942bf0f36d4dc9d39947e3d3863b10f9a2ce4b1703729b3ddfcc6ee12f820cce1e7466d838bb33a199

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
177bfaa3b650bf52854a3a8506371541

SHA1
64af18d3252150f18d9d34c3ad8bbc6c1e404f81

SHA256
00ebde35a895c1ccedfa56a7c49144605c83f839dad9e1bb991f15016e294e2e

SHA512
632fffd0575be245628944a98e0b24c3e36d4142c55db1a040133bb395d80ea6f49d364e533d58f0c0f5221dda1f27c700bec67e196eb52b11e2ba0fc7382027

Download Submit
/data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
536b2e945f3fb48dc80500b59cb2b65b

SHA1
000b7abb55606b774f21ba7c9dddf26d58626bf0

SHA256
28e5eb6eb107fc4f08c40f29dd89919405c52718430485fc23939bde9b51e71d

SHA512
47d5925249d5dbbcff46d0f9af85d4bf59b113a7839fa43989392f6b8a51405ab2c90cda1ba6f5f890c69a127cc3cf92e95a0d5b988b98393ffdba8ee9042794

Download Submit
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/com.crashlytics.settings.json

Filesize
710B

MD5
4cebdea2f0c4daca6f8cf3026f307aec

SHA1
80e8b93c57bded430629a9d6ef9cb45d0cfb688c

SHA256
14254b0682dd63bec394dfd35b77c08e27a22956c577f8d300e39e05150a5c02

SHA512
9fd48ba6ee9ee7efacd7adc4c812594a80d3d977115b1d35f293cceadd30f50f855eb6f0f9572712310aa16f175b9c1d3e832c6528c1d5cace070107d105848e

Download Submit
/data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/open-sessions/6775F75503D3000113ED97C3E6433A08/report

Filesize
736B

MD5
d85f4fafde29f9cbd27c5a308556a0ba

SHA1
d4950ee55ddcb196b07d38286a1e07f31843926c

SHA256
0f180e553572d725179c174aad32284ac946e9c4892bd99d7cfb294628a93a12

SHA512
6ce023bc19542c3a4dc3d633c3011b0700a76159c23f34b8393170aacad757c637b739c862c818ffa9fb6737b5a3dd3824687ff6a9d5d3c3b328ad3714dda263

Download Submit
/data/data/com.makemytrip/files/PersistedInstallation4778157777058507952tmp

Filesize
90B

MD5
8cb166d3b79f54ea70724d9cc4571dd4

SHA1
1427fc02122bd4a77428db899ee2562c20ce4804

SHA256
c236bea361f28c9dd19bd0063255c3b069e58e22c25e6d5e3e6c06b632b25fb4

SHA512
f6c877ca17ae5f0a6476ab6029236f8ef5e41d76c6f04709ed589223555feed2e1ca30d027ea57762cbb3a20e74732c52b75820effc6d758fa01749af0371ab2

Download Submit
/data/data/com.makemytrip/files/PersistedInstallation938480636491852148tmp

Filesize
561B

MD5
55cec0c7709b40c8685dd40075e05178

SHA1
a4ab4b5c73a61be1e8da774f803d6acff4e483a9

SHA256
f70ef721cdb750b64f66f459d92dfc13363696458349ac6f34ed7087ec7885ab

SHA512
bc52ca17c95215a29959c65f561d9d9843d7972a81c5fb47d745877d088fca58ccfb153d7a5349a70eed0766bef862dbc24fc0da04a740ce248e2f81c2fb7b51

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
765644870cbe6d26bd623fc90478f910

SHA1
7f541979500edda1db1d4ad382a4926a632b3ad7

SHA256
c83808221a1164a91b0b966850e3be49d9d10f0a550aadc9498f1a27fff675ab

SHA512
8e501b5a359c05f590ad6bdb6ab07990f34205a96a020b4687c13380b4b314f1512c9214f1001b9515f313a8e124a747b359aee2882d20f785104322717e50b4

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
a5e5aec9a28ad12b824aa0852c85339f

SHA1
7ba6f1e641f19cee11fc6e080b90c7bd9d116a07

SHA256
02ea6af8ca65c5395f010bf16ae6440000e519cfc29833b0ed10184d51fa6140

SHA512
39431d538f6d52c369c9fa8121d90b2b8910c092aebc087bdd568dd9f8a903fa044437462c72602bdb851a796313f500b77fccc17af0056bd3be409dbca86998

Download Submit
/data/data/com.makemytrip/no_backup/androidx.work.workdb-wal

Filesize
92KB

MD5
aded8bb93b712ce0dbd7de4661e33302

SHA1
1f5c603a440c58a9824dbb7cdcfe25e565b45f0f

SHA256
0b6431d1adea0245bc74acd6684591e77814feeca781b463a124904d7dbc47a4

SHA512
dd3f02ff1166bd571a0cd33c5b24d73ab248746ed43d35bb944817dcbf28860ac13ce785b6f6836ba87598ffaf23c45a86118026c4b15cccdad1160778c66819

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads