Analysis
- max time kernel
23s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260129-en - resource tags
arch:x64arch:x86image:android-x64-20260129-enlocale:en-usos:android-10-x64system - submitted
09/02/2026, 12:20
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
TikTok18.apk
Resource
android-x86-arm-20260129-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
TikTok18.apk
Resource
android-x64-20260129-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
TikTok18.apk
Resource
android-x64-arm64-20260129-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
base.apk
Resource
android-x86-arm-20260129-en
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
base.apk
Resource
android-x64-20260129-en
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
base.apk
Resource
android-x64-arm64-20260129-en
9 signatures
150 seconds
General
- Target TikTok18.apk
- Size 17.0MB
- Sample260209-phr8dsd12g
- SHA256 4284e6bbc2fc274d8b0a1f37f91408efc0404e4cae0ba28abc4d583bc59af6bd
- MD5 e44f95c280846df11a96aeaddaf64cb5
- SHA1 feff217787511a2d15f48aefaf1f43651fcef1a4
- SHA512 7832f752e3d0538b4fee836175447966c0aaf2be178e491aaf65e1e0ed7acd19e7ee0df5d9e05eb28968f2fc9819f1773a0e09e8fbac2ba65c3e832d58284b21
- SSDEEP 393216:hrzR6Q6v6Q6rQMt+QC1W39C54ZwzrdeuWtAEWS98yfLzasWnC:hrsQdQRMt+Qb9C/hEt99fLXyC
- TLSH T11D07227BFB46B85EC5F3573785B19E32514B3D654B4386836808B228497BAEC0F19BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/net.dress.absorb/app_major/YN.json 5084 net.dress.absorb - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener net.dress.absorb - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone net.dress.absorb - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver net.dress.absorb - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo net.dress.absorb - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo net.dress.absorb
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/net.dress.absorb/app_major/YN.json
- Size 2.6MB
- SHA256 8bdeb1e80e44e18d6a684afbcc95ae260298b65c77206ba0bcd1eee25dbc753c
- MD5 38af2ae1d68d43655ccca8f885611138
- SHA1 baafb75c4cba18edbf2fd5fec7d1ba5794b95f73
- SHA512 e5358923ce40d235e58ba2c52145969f3547c0d9db1270afb951c53f233bf42aff7876a0b5a520af66f431fde0fe65e1da466dad25298d0e2a9ea378edcf61c1
- SSDEEP 49152:XrvYHcQxPdZR/CwztS29MOi80MsMjKPaH2lsq1CTklbW3gheyuGvslmmrj:bvoNTZ62280TMjKyH2lP1CTDCslmmrj
- TLSH T19FC533876027FA203BD659BA02E04D7778B700646A0BFE7CD102AD579EDCCED7548E26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/net.dress.absorb/app_major/YN.json
- Size 2.6MB
- SHA256 82b88dc4a0df055f5f10c8c83351f98bd79c535ea7309efae6444f33154a1b42
- MD5 353a813cac51168810ddf5e05fee149c
- SHA1 e612911e8b51953bd07ab66f386a66cb50bb2d05
- SHA512 5a6721016cbb2d74bea80d751b0bc3a84627c5831af9c6926714da645a70b4e33cdd1a1c86fc8427f4ac7abd011b312ae32fed94d5a70d57953e7313b8357eb5
- SSDEEP 49152:cyz5Nl2N1D6i7uBD57BQW7SwnvaG+mZTQzba2Se83WVAhgJHJFYcCq1bbXwD674w:1UrGi7INNv1vxBQ/IB3YAiWcCq1nZB+m
- TLSH T126C5333137ABC2141DFD4177D7AD9C82EC5F95E29D2A80868CF90891D1C69C3F9BA1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/net.dress.absorb/app_major/YN.json
- Size 6.7MB
- SHA256 94ee948c307f116348c4ad2472ef6242397c80624e097265e32f30bd9f7ee584
- MD5 b3b547d11e79c25186a0f853e6ad64c5
- SHA1 8a1fd7f3569c6a0bdbfd7766ae99b8285da9bb22
- SHA512 da157ca1a93e57737350f7b669c4dbf13888ee0e9d51f1480772556e0631cd7ce6baae38a0dab401c7b246ec9e81ea1e73f1c998b30673284788b70a72ffa551
- SSDEEP 98304:7kGK56K62XXbh39mJhJT0ZNezB9CQRPhl1KAO:gGfhJbaV
- TLSH T168668E13AB5A4C32E15F53352AF71306B73253DABF478F461048E5FC7D832D16AA92A8
- MD5 SHA1 SHA512 SSDEEP TLSH