ce0c36194eb90795d1f89a6cccc812463c4bf7bfc4c831e7d49ed65e8a7ad75c

Resubmissions

11/09/2026, 00:16

260911-aksjlszydx10

23/07/2026, 16:24

260723-twdpda1shv10

06/11/2025, 00:33

251106-av97eaxlbr7

04/11/2025, 18:15

251104-wv2qxsej7x6

Analysis

max time kernel
22s
max time network
32s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
06/11/2025, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TikTok18.apk
Size 6.8MB
Sample251106-av97eaxlbr
SHA256 ce0c36194eb90795d1f89a6cccc812463c4bf7bfc4c831e7d49ed65e8a7ad75c
MD5 366b5c16e764b665896e3c027d391253
SHA1 a88b49401483820baff031ad779da5ebfa1563f0
SHA512 f10cc627f55a1fa1e1686b2c6db0caf660300130967b8e09c50413b1837060db979a499717dfd0211d3029dddb5f06329f33f4e452fa84f36557df45536496ab
SSDEEP 196608:DMnAyOfGEp1laZ9yI3PdC8X/T4qYydv0p3/1:OWNp1EfdJXo53/1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery persistence

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.p99a7e7cba.tiktok18

Requests dangerous framework permissions 25 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.p99a7e7cba.tiktok18

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.p99a7e7cba.tiktok18

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.p99a7e7cba.tiktok18

com.p99a7e7cba.tiktok18
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4210

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chiken.apk

Path /data/data/com.p99a7e7cba.tiktok18/cache/chiken.apk
Size 5.3MB
SHA256 9c88e5344f8c45192d7390c618b385959169e698448318e7a5c179d00bf6dbf3
MD5 b6da05a5b84eff260a959fa84fbdf4c9
SHA1 362b824e1eb2a7cad2691431087c6f19d19720a6
SHA512 045a41a32ebc3a4d50b643e7f4c11ab47db11cbdd234dd14b85e1151dd7d25ba17c8b29e31c341eb32c9c08793785c80ef54187380124864083c3698f866a112
SSDEEP 98304:5zah/HXu1V1awlysREdOT3r6pzayGoCnmKVnVPXn6Ct3lf:5zahfXuHlysJT7VTXnfd6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/com.p99a7e7cba.tiktok18/files/profileInstalled
Size 24B
SHA256 c034b7a3873419868400f1d44da15ce9826a4b0a44b67dfee32b4c278af3f6d9
MD5 877482b331332f12a09f200440130c30
SHA1 6bcc936bc2bac7e41e4684041ee0c0abb93aeb8d
SHA512 e0d5c475022f8962244f2f66d2ff6a3d66fbdfa6cde847eb6ff77e6cc45cca39c16a03eb185d58ae833ff837bf2f6a35a5e8969ccadee864bbc8bfb258d375e5
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.p99a7e7cba.tiktok18/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 e532f07909bc7c8413dc3dd09e342f53a435361c048c74b5bcff87ea72adae46
MD5 ad1f4e31fbb4ad990ff5abb29e40a8b5
SHA1 04ded2af77e2cb072e6bd3d84776a5f5eda3a535
SHA512 fbb057629ebc2dbcdec1fa4eca249f605bdbed7f5318c37d96bf299bf9f338a11ac37d7cd6af0c9fe6fa764d8b511532dd6b42fec8fd08ffb68601dc4a4074a2
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.p99a7e7cba.tiktok18/primary.prof
Size 1KB
SHA256 e3e20aa08adf1adcb6cefd7a0528f2ab224e4b013ab5af0b39a7f5f7f3e20cf6
MD5 7cb51b6eec01991b69f43dc4b7e06614
SHA1 52bc4727f5e27808936c0cee241f27820b65f113
SHA512 3f81d029393f06a482d1cd4c292d5ce91015916d796b2e5c476748633c68414632653f629c2c3cab0ec4998b756464a13efedf4228216048cee5638bb03b4e1e
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads