80bb990332c47e720092bad37a3cfd245336c6fcb44078e1e7920e11b802b54a

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/06/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mparivahan.apk
Size 11.3MB
Sample260602-apfevahx7x
SHA256 80bb990332c47e720092bad37a3cfd245336c6fcb44078e1e7920e11b802b54a
MD5 227541763887bc717b5c873115eb5344
SHA1 845b91637b1df4b4787fb6810c615d9397523e4b
SHA512 16ddd07f61c14524547d8aca1328dba892e53e9f11e1720b0eef8f6cace9e722de9445be1acc7d7eac3b873ba42209694b0fd951cce97d92026f28c77e00855b
SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K9:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgo
TLSH
T19DC633ADB131335DD677A23061841DD34E028578BB0E34B1B8A0277E4DDB6F69369B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.elong.android.hotel/app_mph_dex/apk.crazy-v1.security.jar	5024	com.elong.android.hotel
/data/user/0/com.elong.android.hotel/app_mph_dex/apk.crazy-v1.security.jar	5024	com.elong.android.hotel

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.elong.android.hotel

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	pastebin.com
13	pastebin.com

com.elong.android.hotel
1⤵
- Loads dropped Dex/Jar
- Checks the application is allowed to request package installs through the package installer
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control