Malware Analysis Report

2025-08-05 19:09

Sample ID 240518-wee7zsfe4z
Target http://tiktok.com
Tags
discovery evasion collection
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

Threat Level: Shows suspicious behavior

The file http://tiktok.com was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion collection

Checks CPU information

Checks memory information

Reads the content of photos stored on the user's device.

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 17:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 17:49

Reported

2024-05-18 18:13

Platform

android-x86-arm-20240514-en

Max time kernel

25s

Max time network

1076s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
GB 142.250.200.14:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 tiktok.com udp
GB 18.245.218.93:80 tiktok.com tcp
GB 18.245.218.93:80 tiktok.com tcp
GB 18.245.218.93:443 tiktok.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 142.250.187.202:443 safebrowsing.googleapis.com tcp
US 1.1.1.1:53 www.tiktok.com udp
GB 23.59.171.9:443 www.tiktok.com tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.68:443 www.google.com tcp
GB 142.250.187.234:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 dzvgbhjbu udp
US 1.1.1.1:53 evqwzzxqjryvg udp
US 1.1.1.1:53 mdivkiaqjmh udp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.227:80 tcp
GB 172.217.16.228:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.2:443 tcp
GB 142.250.200.35:443 tcp
GB 142.250.200.14:443 tcp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.200.35:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 17:49

Reported

2024-05-18 18:20

Platform

android-x64-20240514-en

Max time kernel

375s

Max time network

1221s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Reads the content of photos stored on the user's device.

collection
Description Indicator Process Target
URI accessed for read content://media/external/images/media N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 accounts.google.com udp
BE 173.194.76.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
BE 74.125.133.84:443 accounts.google.com tcp
US 1.1.1.1:53 tiktok.com udp
DE 18.66.112.128:80 tiktok.com tcp
DE 18.66.112.128:80 tiktok.com tcp
DE 18.66.112.128:443 tiktok.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 142.250.180.10:443 safebrowsing.googleapis.com tcp
US 1.1.1.1:53 www.tiktok.com udp
GB 23.200.147.24:443 www.tiktok.com tcp
US 1.1.1.1:53 sf16-website-login.neutral.ttwstatic.com udp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 173.222.211.123:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
GB 23.200.147.24:443 www.tiktok.com tcp
US 1.1.1.1:53 sf16-sg.tiktokcdn.com udp
GB 2.19.117.107:443 sf16-sg.tiktokcdn.com tcp
US 1.1.1.1:53 rgqxxnkbqsbwbyp udp
US 1.1.1.1:53 enhppph udp
US 1.1.1.1:53 zzjhunnlqibmoue udp
US 1.1.1.1:53 update.googleapis.com udp
GB 172.217.16.227:443 update.googleapis.com tcp
US 1.1.1.1:53 mon-i18n.tiktokv.com udp
GB 71.18.4.241:443 mon-i18n.tiktokv.com tcp
US 1.1.1.1:53 storage.googleapis.com udp
GB 172.217.16.251:443 storage.googleapis.com tcp
US 1.1.1.1:53 lf16-tiktok-common.ibytedtos.com udp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 104.86.110.50:443 lf16-tiktok-common.ibytedtos.com tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.179.226:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.204.67:443 update.googleapis.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp

Files

files/dom-0.html

MD5 08263fd373b50d36bfcde454adb28611
SHA1 a8a002a8b4052be57591cb494a6a4837eb67508e
SHA256 2f5cc0888fded57b8c6262534fe1d020064c1c465ae30c3fa5a6e31902485ade
SHA512 2a233917d054f3c02a61d5a899302fcb5692f14ac583ed8f9ca0913c0ceee0e35a84ff7d2230f686c365be73ecfdc83ffaff9d0e783fd2d8824f0e6c6108faf2

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-18 17:49

Reported

2024-05-18 18:30

Platform

android-x64-arm64-20240514-en

Max time kernel

1226s

Max time network

1213s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.106:443 tcp
GB 216.58.201.106:443 tcp
US 1.1.1.1:53 tiktok.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 173.194.76.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 tiktok.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
BE 74.125.133.84:443 accounts.google.com tcp
US 3.162.140.51:80 tiktok.com tcp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 3.162.140.51:443 tiktok.com tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 3.162.140.51:443 tiktok.com tcp
US 1.1.1.1:53 www.tiktok.com udp
GB 23.200.147.42:443 www.tiktok.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 216.58.204.74:443 safebrowsing.googleapis.com tcp
US 1.1.1.1:53 sf16-website-login.neutral.ttwstatic.com udp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
GB 173.222.211.114:443 sf16-website-login.neutral.ttwstatic.com tcp
US 1.1.1.1:53 libraweb.tiktokw.eu udp
US 1.1.1.1:53 mcs-va-useast2a.tiktokv.com udp
GB 23.200.147.25:443 libraweb.tiktokw.eu tcp
GB 95.100.104.9:443 mcs-va-useast2a.tiktokv.com tcp
US 1.1.1.1:53 mon-i18n.tiktokv.com udp
GB 71.18.4.241:443 mon-i18n.tiktokv.com tcp
GB 95.100.104.9:443 mcs-va-useast2a.tiktokv.com tcp
GB 71.18.4.241:443 mon-i18n.tiktokv.com tcp
GB 23.200.147.42:443 www.tiktok.com tcp
GB 71.18.4.241:443 mon-i18n.tiktokv.com tcp
US 1.1.1.1:53 p16-va.tiktokcdn.com udp
US 1.1.1.1:53 s20.tiktokcdn.com udp
US 1.1.1.1:53 v16.tiktokcdn.com udp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 storage.googleapis.com udp
GB 172.217.169.27:443 storage.googleapis.com tcp
US 1.1.1.1:53 iwcwwiifi udp
US 1.1.1.1:53 tccerpus udp
US 1.1.1.1:53 wlxtnapzlis udp
US 1.1.1.1:53 lf16-tiktok-common.ibytedtos.com udp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
GB 2.16.34.25:443 lf16-tiktok-common.ibytedtos.com tcp
US 1.1.1.1:53 mssdk-i18n.tiktok.com udp
GB 2.18.66.139:443 mssdk-i18n.tiktok.com tcp
US 1.1.1.1:53 clients1.google.com udp
GB 172.217.16.238:443 clients1.google.com tcp
GB 2.18.66.139:443 mssdk-i18n.tiktok.com tcp
US 1.1.1.1:53 mcs-ie.tiktokw.eu udp
GB 23.200.147.48:443 mcs-ie.tiktokw.eu tcp
US 1.1.1.1:53 p16-sign-useast2a.tiktokcdn.com udp
US 1.1.1.1:53 p77-sign-va.tiktokcdn.com udp
GB 84.17.50.38:443 p77-sign-va.tiktokcdn.com tcp
US 1.1.1.1:53 p16-sign-va.tiktokcdn.com udp
US 1.1.1.1:53 p16-sg.tiktokcdn.com udp
GB 88.221.134.138:443 p16-sign-va.tiktokcdn.com tcp
GB 173.222.211.106:443 p16-sg.tiktokcdn.com tcp
US 1.1.1.1:53 stun.l.google.com udp
US 1.1.1.1:53 p16-sign-useast2a.tiktokcdn.com udp
US 1.1.1.1:53 v16-webapp-prime.tiktok.com udp
GB 2.19.117.39:443 v16-webapp-prime.tiktok.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
US 1.1.1.1:53 mon.tiktokv.com udp
GB 95.101.28.49:443 mon.tiktokv.com tcp
GB 95.101.28.49:443 mon.tiktokv.com tcp
GB 2.19.117.39:443 v16-webapp-prime.tiktok.com tcp
GB 2.19.117.39:443 v16-webapp-prime.tiktok.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
US 1.1.1.1:53 sf16-sg.tiktokcdn.com udp
GB 2.16.34.41:443 sf16-sg.tiktokcdn.com tcp
GB 95.100.104.9:443 mcs-va-useast2a.tiktokv.com tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
GB 142.250.178.3:443 update.googleapis.com tcp
US 1.1.1.1:53 www.tiktok.com udp
US 1.1.1.1:53 www.tiktok.com udp
US 1.1.1.1:53 www.tiktok.com udp
GB 2.16.170.41:443 www.tiktok.com tcp
US 1.1.1.1:53 www.tiktok.com udp
GB 2.16.170.59:443 www.tiktok.com tcp
GB 172.217.169.34:443 tcp
GB 142.250.187.195:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 mcs-va-useast2a.tiktokv.com udp
GB 95.100.104.7:443 mcs-va-useast2a.tiktokv.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.14:443 android.apis.google.com tcp
US 1.1.1.1:53 mcs-va-useast2a.tiktokv.com udp
GB 92.122.54.116:443 mcs-va-useast2a.tiktokv.com tcp
US 1.1.1.1:53 mcs-va-useast2a.tiktokv.com udp
GB 23.40.43.120:443 mcs-va-useast2a.tiktokv.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp

Files

files/dom-0.html

MD5 246390c7f596b13529a2a3b5c4e2cb04
SHA1 c24f0ab7bda977b4f0eac83f5c5a4cceb25f778c
SHA256 b0b48fb4eccee2cf2a7a610d63e43c8b2044a70d0a9e095e5048b17ad6ca606e
SHA512 1cf89c75cbd951036c194b1a6eb9c2632c1063abda0d7bfdf9496f7d7e9d5f3d9471f918cc4b2d01f037506cca9fea5ba27c7aba15e2288416e24a4a674c5609