769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf

Analysis

max time kernel
10s
max time network
168s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
02/01/2025, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf.apk
Size 53.0MB
Sample250102-cqs4faxra1
SHA256 769840a979ee956291e924d5cb95061f424adc3221b26d85e0e8e7f65777decf
MD5 85ed51b00887d331b476f9568222743c
SHA1 fba6938bd6a675b21b4d77d49a58e7fc0b8f9e4d
SHA512 e097b553c7682849580c0841f89e7141f92a1c2c6e6252496c3e61f504c1e7522953ffb9a61cb129f14100e4e6d39433f7a2c21a3596029422b1c5d27a6c962a
SSDEEP 786432:phP09KrszNOTCzZSs1LllhySA2yFy5msUonUdnp5ZxQ56OcpvcZbE33bHeVjKek7:f09Kgzacht85sXU0DcpvkEnoYcxiJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.makemytrip
/system/xbin/su	com.makemytrip

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.makemytrip

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.makemytrip

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.makemytrip

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.makemytrip:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.registerReceiver	com.makemytrip

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.makemytrip

com.makemytrip
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5101

com.makemytrip:playcore_missing_splits_activity
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5206

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.makemytrip/databases/com.google.android.datatransport.events
Size 56KB
SHA256 b7fb00e4fd5614b4820b6d2e183d626e697e866b5758cec46480dae8164724ce
MD5 3c40fa54b03e1a0028bcd90f80962dec
SHA1 7462a6a6f70647ac3a534ddd09c5236b05d887ee
SHA512 9c63aac5e7e2650b6f8ceacde2719fe05bb6a6cf8003e644741baf823da6b5744f77a3f356ee7027572cd882752d9cc1c2d94ecd28d3e334c1037874d03e1a95
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSw:8MEX0wIyNjaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 db78d832269ff1d66f97dda76734f07384f877bef4f6563fd641c6536d42331e
MD5 6a05f98f61c57c4c38c0e677ec483bb8
SHA1 eb3e83511acdebd90c4846bef9cce8072238e195
SHA512 f1daf4267f471e98e124d1b6991cee019081766be5dce7942bf0f36d4dc9d39947e3d3863b10f9a2ce4b1703729b3ddfcc6ee12f820cce1e7466d838bb33a199
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 00ebde35a895c1ccedfa56a7c49144605c83f839dad9e1bb991f15016e294e2e
MD5 177bfaa3b650bf52854a3a8506371541
SHA1 64af18d3252150f18d9d34c3ad8bbc6c1e404f81
SHA512 632fffd0575be245628944a98e0b24c3e36d4142c55db1a040133bb395d80ea6f49d364e533d58f0c0f5221dda1f27c700bec67e196eb52b11e2ba0fc7382027
SSDEEP 6:7+/l9GwQn1v3g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKQ:7+tAwOqLiuWdwRmBEyPbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.makemytrip/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 28e5eb6eb107fc4f08c40f29dd89919405c52718430485fc23939bde9b51e71d
MD5 536b2e945f3fb48dc80500b59cb2b65b
SHA1 000b7abb55606b774f21ba7c9dddf26d58626bf0
SHA512 47d5925249d5dbbcff46d0f9af85d4bf59b113a7839fa43989392f6b8a51405ab2c90cda1ba6f5f890c69a127cc3cf92e95a0d5b988b98393ffdba8ee9042794
SSDEEP 6:7+/l9taPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK29A/B:7+tWqLJdTRmBEyPbHOB
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.crashlytics.settings.json

Path /data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/com.crashlytics.settings.json
Size 710B
SHA256 14254b0682dd63bec394dfd35b77c08e27a22956c577f8d300e39e05150a5c02
MD5 4cebdea2f0c4daca6f8cf3026f307aec
SHA1 80e8b93c57bded430629a9d6ef9cb45d0cfb688c
SHA512 9fd48ba6ee9ee7efacd7adc4c812594a80d3d977115b1d35f293cceadd30f50f855eb6f0f9572712310aa16f175b9c1d3e832c6528c1d5cace070107d105848e
MD5 SHA1 SHA512

Submit Download

report

Path /data/data/com.makemytrip/files/.com.google.firebase.crashlytics.files.v2:com.makemytrip/open-sessions/6775F75503D3000113ED97C3E6433A08/report
Size 736B
SHA256 0f180e553572d725179c174aad32284ac946e9c4892bd99d7cfb294628a93a12
MD5 d85f4fafde29f9cbd27c5a308556a0ba
SHA1 d4950ee55ddcb196b07d38286a1e07f31843926c
SHA512 6ce023bc19542c3a4dc3d633c3011b0700a76159c23f34b8393170aacad757c637b739c862c818ffa9fb6737b5a3dd3824687ff6a9d5d3c3b328ad3714dda263
MD5 SHA1 SHA512

Submit Download

PersistedInstallation4778157777058507952tmp

Path /data/data/com.makemytrip/files/PersistedInstallation4778157777058507952tmp
Size 90B
SHA256 c236bea361f28c9dd19bd0063255c3b069e58e22c25e6d5e3e6c06b632b25fb4
MD5 8cb166d3b79f54ea70724d9cc4571dd4
SHA1 1427fc02122bd4a77428db899ee2562c20ce4804
SHA512 f6c877ca17ae5f0a6476ab6029236f8ef5e41d76c6f04709ed589223555feed2e1ca30d027ea57762cbb3a20e74732c52b75820effc6d758fa01749af0371ab2
MD5 SHA1 SHA512

Submit Download

PersistedInstallation938480636491852148tmp

Path /data/data/com.makemytrip/files/PersistedInstallation938480636491852148tmp
Size 561B
SHA256 f70ef721cdb750b64f66f459d92dfc13363696458349ac6f34ed7087ec7885ab
MD5 55cec0c7709b40c8685dd40075e05178
SHA1 a4ab4b5c73a61be1e8da774f803d6acff4e483a9
SHA512 bc52ca17c95215a29959c65f561d9d9843d7972a81c5fb47d745877d088fca58ccfb153d7a5349a70eed0766bef862dbc24fc0da04a740ce248e2f81c2fb7b51
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.makemytrip/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.makemytrip/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 c83808221a1164a91b0b966850e3be49d9d10f0a550aadc9498f1a27fff675ab
MD5 765644870cbe6d26bd623fc90478f910
SHA1 7f541979500edda1db1d4ad382a4926a632b3ad7
SHA512 8e501b5a359c05f590ad6bdb6ab07990f34205a96a020b4687c13380b4b314f1512c9214f1001b9515f313a8e124a747b359aee2882d20f785104322717e50b4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.makemytrip/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.makemytrip/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 02ea6af8ca65c5395f010bf16ae6440000e519cfc29833b0ed10184d51fa6140
MD5 a5e5aec9a28ad12b824aa0852c85339f
SHA1 7ba6f1e641f19cee11fc6e080b90c7bd9d116a07
SHA512 39431d538f6d52c369c9fa8121d90b2b8910c092aebc087bdd568dd9f8a903fa044437462c72602bdb851a796313f500b77fccc17af0056bd3be409dbca86998
SSDEEP 6:KxbK+QMy9FZdrlOERX4PBX4ogLugMBX4suuK+/LEOClWOw2:KxbKO8zdTRmBEyPbP/fPOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.makemytrip/no_backup/androidx.work.workdb-wal
Size 92KB
SHA256 0b6431d1adea0245bc74acd6684591e77814feeca781b463a124904d7dbc47a4
MD5 aded8bb93b712ce0dbd7de4661e33302
SHA1 1f5c603a440c58a9824dbb7cdcfe25e565b45f0f
SHA512 dd3f02ff1166bd571a0cd33c5b24d73ab248746ed43d35bb944817dcbf28860ac13ce785b6f6836ba87598ffaf23c45a86118026c4b15cccdad1160778c66819
SSDEEP 48:C9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9h:I6+hdjnHtDRMpf8UzS6+BD8q0ExPPzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads