c7ecfc9b6b617442ed4569104113d470f8afda0da41993a125c01792209c2d3e

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/06/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mparivahan.apk
Size 11.3MB
Sample260602-appcrahx9s
SHA256 c7ecfc9b6b617442ed4569104113d470f8afda0da41993a125c01792209c2d3e
MD5 e108db0630f52a0fa5335737755c2f3a
SHA1 cf127e4bfe70237dfdc21c51954feaa4ad5861f8
SHA512 fd12ef5d078d11e990b67cc7be017840d3ca27d77290436749ca083715d8c34d4b99caf411b8269ba6bb027a7cc480c680c8925ca9d17f9a19c79ebc11e8c35d
SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K/:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgm
TLSH
T198C633ADB231335DD677A23061841DE34E02C574AB0E34B1B8A0277E4DDB6F69369B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.elong.android.hotel/app_mph_dex/apk.crazy-v1.security.jar	5097	com.elong.android.hotel
/data/user/0/com.elong.android.hotel/app_mph_dex/apk.crazy-v1.security.jar	5097	com.elong.android.hotel

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.elong.android.hotel

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	pastebin.com
9	pastebin.com

com.elong.android.hotel
1⤵
- Loads dropped Dex/Jar
- Checks the application is allowed to request package installs through the package installer
PID:5097

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control