Analysis Overview
Threat Level: Shows suspicious behavior
The file http://tiktok.com was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks CPU information
Checks memory information
Reads the content of photos stored on the user's device.
MITRE ATT&CK
Mobile Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-18 17:49
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-18 17:49
Reported
2024-05-18 18:13
Platform
android-x86-arm-20240514-en
Max time kernel
25s
Max time network
1076s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.android.chrome
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.200.14:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | tiktok.com | udp |
| GB | 18.245.218.93:80 | tiktok.com | tcp |
| GB | 18.245.218.93:80 | tiktok.com | tcp |
| GB | 18.245.218.93:443 | tiktok.com | tcp |
| US | 1.1.1.1:53 | safebrowsing.googleapis.com | udp |
| GB | 142.250.187.202:443 | safebrowsing.googleapis.com | tcp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| GB | 23.59.171.9:443 | www.tiktok.com | tcp |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 172.217.169.68:443 | www.google.com | tcp |
| GB | 142.250.187.234:443 | tcp | |
| US | 1.1.1.1:53 | update.googleapis.com | udp |
| US | 1.1.1.1:53 | dzvgbhjbu | udp |
| US | 1.1.1.1:53 | evqwzzxqjryvg | udp |
| US | 1.1.1.1:53 | mdivkiaqjmh | udp |
| GB | 142.250.180.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.187.234:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 142.250.179.227:80 | tcp | |
| GB | 172.217.16.228:443 | tcp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.200.2:443 | tcp | |
| GB | 142.250.200.35:443 | tcp | |
| GB | 142.250.200.14:443 | tcp | |
| GB | 142.250.187.234:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 142.250.200.35:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.46:443 | android.apis.google.com | tcp |
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-18 17:49
Reported
2024-05-18 18:20
Platform
android-x64-20240514-en
Max time kernel
375s
Max time network
1221s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Reads the content of photos stored on the user's device.
| Description | Indicator | Process | Target |
| URI accessed for read | content://media/external/images/media | N/A | N/A |
Processes
com.android.chrome
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | accounts.google.com | udp |
| BE | 173.194.76.84:443 | accounts.google.com | tcp |
| US | 1.1.1.1:53 | accounts.google.com | udp |
| BE | 74.125.133.84:443 | accounts.google.com | tcp |
| US | 1.1.1.1:53 | tiktok.com | udp |
| DE | 18.66.112.128:80 | tiktok.com | tcp |
| DE | 18.66.112.128:80 | tiktok.com | tcp |
| DE | 18.66.112.128:443 | tiktok.com | tcp |
| US | 1.1.1.1:53 | safebrowsing.googleapis.com | udp |
| GB | 142.250.180.10:443 | safebrowsing.googleapis.com | tcp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| GB | 23.200.147.24:443 | www.tiktok.com | tcp |
| US | 1.1.1.1:53 | sf16-website-login.neutral.ttwstatic.com | udp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.232:443 | ssl.google-analytics.com | tcp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| GB | 173.222.211.123:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 142.250.179.228:443 | www.google.com | tcp |
| GB | 23.200.147.24:443 | www.tiktok.com | tcp |
| US | 1.1.1.1:53 | sf16-sg.tiktokcdn.com | udp |
| GB | 2.19.117.107:443 | sf16-sg.tiktokcdn.com | tcp |
| US | 1.1.1.1:53 | rgqxxnkbqsbwbyp | udp |
| US | 1.1.1.1:53 | enhppph | udp |
| US | 1.1.1.1:53 | zzjhunnlqibmoue | udp |
| US | 1.1.1.1:53 | update.googleapis.com | udp |
| GB | 172.217.16.227:443 | update.googleapis.com | tcp |
| US | 1.1.1.1:53 | mon-i18n.tiktokv.com | udp |
| GB | 71.18.4.241:443 | mon-i18n.tiktokv.com | tcp |
| US | 1.1.1.1:53 | storage.googleapis.com | udp |
| GB | 172.217.16.251:443 | storage.googleapis.com | tcp |
| US | 1.1.1.1:53 | lf16-tiktok-common.ibytedtos.com | udp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 104.86.110.50:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 142.250.178.4:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 142.250.200.4:443 | www.google.com | tcp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| GB | 142.250.179.226:443 | tcp | |
| US | 1.1.1.1:53 | update.googleapis.com | udp |
| GB | 216.58.204.67:443 | update.googleapis.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.212.238:443 | android.apis.google.com | tcp |
Files
files/dom-0.html
| MD5 | 08263fd373b50d36bfcde454adb28611 |
| SHA1 | a8a002a8b4052be57591cb494a6a4837eb67508e |
| SHA256 | 2f5cc0888fded57b8c6262534fe1d020064c1c465ae30c3fa5a6e31902485ade |
| SHA512 | 2a233917d054f3c02a61d5a899302fcb5692f14ac583ed8f9ca0913c0ceee0e35a84ff7d2230f686c365be73ecfdc83ffaff9d0e783fd2d8824f0e6c6108faf2 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-18 17:49
Reported
2024-05-18 18:30
Platform
android-x64-arm64-20240514-en
Max time kernel
1226s
Max time network
1213s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.android.chrome
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.201.106:443 | tcp | |
| GB | 216.58.201.106:443 | tcp | |
| US | 1.1.1.1:53 | tiktok.com | udp |
| US | 1.1.1.1:53 | accounts.google.com | udp |
| BE | 173.194.76.84:443 | accounts.google.com | tcp |
| US | 1.1.1.1:53 | accounts.google.com | udp |
| US | 1.1.1.1:53 | tiktok.com | udp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| BE | 74.125.133.84:443 | accounts.google.com | tcp |
| US | 3.162.140.51:80 | tiktok.com | tcp |
| GB | 142.250.200.40:443 | ssl.google-analytics.com | tcp |
| US | 3.162.140.51:443 | tiktok.com | tcp |
| GB | 142.250.178.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| US | 3.162.140.51:443 | tiktok.com | tcp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| GB | 23.200.147.42:443 | www.tiktok.com | tcp |
| US | 1.1.1.1:53 | safebrowsing.googleapis.com | udp |
| GB | 216.58.204.74:443 | safebrowsing.googleapis.com | tcp |
| US | 1.1.1.1:53 | sf16-website-login.neutral.ttwstatic.com | udp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| GB | 173.222.211.114:443 | sf16-website-login.neutral.ttwstatic.com | tcp |
| US | 1.1.1.1:53 | libraweb.tiktokw.eu | udp |
| US | 1.1.1.1:53 | mcs-va-useast2a.tiktokv.com | udp |
| GB | 23.200.147.25:443 | libraweb.tiktokw.eu | tcp |
| GB | 95.100.104.9:443 | mcs-va-useast2a.tiktokv.com | tcp |
| US | 1.1.1.1:53 | mon-i18n.tiktokv.com | udp |
| GB | 71.18.4.241:443 | mon-i18n.tiktokv.com | tcp |
| GB | 95.100.104.9:443 | mcs-va-useast2a.tiktokv.com | tcp |
| GB | 71.18.4.241:443 | mon-i18n.tiktokv.com | tcp |
| GB | 23.200.147.42:443 | www.tiktok.com | tcp |
| GB | 71.18.4.241:443 | mon-i18n.tiktokv.com | tcp |
| US | 1.1.1.1:53 | p16-va.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | s20.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | v16.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | update.googleapis.com | udp |
| US | 1.1.1.1:53 | storage.googleapis.com | udp |
| GB | 172.217.169.27:443 | storage.googleapis.com | tcp |
| US | 1.1.1.1:53 | iwcwwiifi | udp |
| US | 1.1.1.1:53 | tccerpus | udp |
| US | 1.1.1.1:53 | wlxtnapzlis | udp |
| US | 1.1.1.1:53 | lf16-tiktok-common.ibytedtos.com | udp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| GB | 2.16.34.25:443 | lf16-tiktok-common.ibytedtos.com | tcp |
| US | 1.1.1.1:53 | mssdk-i18n.tiktok.com | udp |
| GB | 2.18.66.139:443 | mssdk-i18n.tiktok.com | tcp |
| US | 1.1.1.1:53 | clients1.google.com | udp |
| GB | 172.217.16.238:443 | clients1.google.com | tcp |
| GB | 2.18.66.139:443 | mssdk-i18n.tiktok.com | tcp |
| US | 1.1.1.1:53 | mcs-ie.tiktokw.eu | udp |
| GB | 23.200.147.48:443 | mcs-ie.tiktokw.eu | tcp |
| US | 1.1.1.1:53 | p16-sign-useast2a.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | p77-sign-va.tiktokcdn.com | udp |
| GB | 84.17.50.38:443 | p77-sign-va.tiktokcdn.com | tcp |
| US | 1.1.1.1:53 | p16-sign-va.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | p16-sg.tiktokcdn.com | udp |
| GB | 88.221.134.138:443 | p16-sign-va.tiktokcdn.com | tcp |
| GB | 173.222.211.106:443 | p16-sg.tiktokcdn.com | tcp |
| US | 1.1.1.1:53 | stun.l.google.com | udp |
| US | 1.1.1.1:53 | p16-sign-useast2a.tiktokcdn.com | udp |
| US | 1.1.1.1:53 | v16-webapp-prime.tiktok.com | udp |
| GB | 2.19.117.39:443 | v16-webapp-prime.tiktok.com | tcp |
| US | 74.125.250.129:19302 | stun.l.google.com | udp |
| US | 1.1.1.1:53 | mon.tiktokv.com | udp |
| GB | 95.101.28.49:443 | mon.tiktokv.com | tcp |
| GB | 95.101.28.49:443 | mon.tiktokv.com | tcp |
| GB | 2.19.117.39:443 | v16-webapp-prime.tiktok.com | tcp |
| GB | 2.19.117.39:443 | v16-webapp-prime.tiktok.com | tcp |
| US | 74.125.250.129:19302 | stun.l.google.com | udp |
| US | 1.1.1.1:53 | sf16-sg.tiktokcdn.com | udp |
| GB | 2.16.34.41:443 | sf16-sg.tiktokcdn.com | tcp |
| GB | 95.100.104.9:443 | mcs-va-useast2a.tiktokv.com | tcp |
| GB | 142.250.178.4:443 | tcp | |
| GB | 142.250.178.4:443 | tcp | |
| US | 1.1.1.1:53 | update.googleapis.com | udp |
| GB | 142.250.178.3:443 | update.googleapis.com | tcp |
| GB | 142.250.178.3:443 | update.googleapis.com | tcp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| GB | 2.16.170.41:443 | www.tiktok.com | tcp |
| US | 1.1.1.1:53 | www.tiktok.com | udp |
| GB | 2.16.170.59:443 | www.tiktok.com | tcp |
| GB | 172.217.169.34:443 | tcp | |
| GB | 142.250.187.195:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | mcs-va-useast2a.tiktokv.com | udp |
| GB | 95.100.104.7:443 | mcs-va-useast2a.tiktokv.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.169.14:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | mcs-va-useast2a.tiktokv.com | udp |
| GB | 92.122.54.116:443 | mcs-va-useast2a.tiktokv.com | tcp |
| US | 1.1.1.1:53 | mcs-va-useast2a.tiktokv.com | udp |
| GB | 23.40.43.120:443 | mcs-va-useast2a.tiktokv.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.212.238:443 | android.apis.google.com | tcp |
Files
files/dom-0.html
| MD5 | 246390c7f596b13529a2a3b5c4e2cb04 |
| SHA1 | c24f0ab7bda977b4f0eac83f5c5a4cceb25f778c |
| SHA256 | b0b48fb4eccee2cf2a7a610d63e43c8b2044a70d0a9e095e5048b17ad6ca606e |
| SHA512 | 1cf89c75cbd951036c194b1a6eb9c2632c1063abda0d7bfdf9496f7d7e9d5f3d9471f918cc4b2d01f037506cca9fea5ba27c7aba15e2288416e24a4a674c5609 |