TikTok18[.]apk | Triage™

General

Target
TikTok18.apk
Size 17.0MB
Sample260209-phr8dsd12g
SHA256 4284e6bbc2fc274d8b0a1f37f91408efc0404e4cae0ba28abc4d583bc59af6bd
MD5 e44f95c280846df11a96aeaddaf64cb5
SHA1 feff217787511a2d15f48aefaf1f43651fcef1a4
SHA512 7832f752e3d0538b4fee836175447966c0aaf2be178e491aaf65e1e0ed7acd19e7ee0df5d9e05eb28968f2fc9819f1773a0e09e8fbac2ba65c3e832d58284b21
SSDEEP 393216:hrzR6Q6v6Q6rQMt+QC1W39C54ZwzrdeuWtAEWS98yfLzasWnC:hrsQdQRMt+Qb9C/hEt99fLXyC
TLSH
T11D07227BFB46B85EC5F3573785B19E32514B3D654B4386836808B228497BAEC0F19BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
TikTok18.apk
unpack001/base.apk

File Explorer

TikTok18.apk

.apk 17.0MB
base.apk

.apk 7.3MB

TikTok18.apk

SHA256 4284e6bbc2fc274d8b0a1f37f91408efc0404e4cae0ba28abc4d583bc59af6bd
MD5 e44f95c280846df11a96aeaddaf64cb5
SHA1 feff217787511a2d15f48aefaf1f43651fcef1a4
SHA512 7832f752e3d0538b4fee836175447966c0aaf2be178e491aaf65e1e0ed7acd19e7ee0df5d9e05eb28968f2fc9819f1773a0e09e8fbac2ba65c3e832d58284b21
SSDEEP 393216:hrzR6Q6v6Q6rQMt+QC1W39C54ZwzrdeuWtAEWS98yfLzasWnC:hrsQdQRMt+Qb9C/hEt99fLXyC
TLSH
T11D07227BFB46B85EC5F3573785B19E32514B3D654B4386836808B228497BAEC0F19BC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d6d9e187fbe8c547954a3bc19687d5bd30e38ade197512bc5b75328d472eaa4e

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Facebook Corporation,OU=Facebook,O=Facebook Mobile,L=Palo Alto,ST=CA,C=US

net.dress.absorb

base.apk

SHA256 85cf1361d652fb9f081bcbb2197f5855b53c70c815f72530b4a4cd6ce0876687
MD5 59f17a0aafb9ffcfaa8a5c1df802015f
SHA1 ef3aa3e2ce15e90dfd001cb3322b7e5cb5ee5854
SHA512 44e0183483ac59219084f6ecf1c65b88476b7f8ab5ad964ac226a8710ae45d5fd802c234018ee00f695634ca7d792b7c13aabdd85d5ac2bb0d773870c9e9eaaf
SSDEEP 196608:n3WeaiKf+OA6jN9AMOXJkB7VYl/i8S3lDOWFcv7u+:3We02O/AM8apS6d1DOm+n
TLSH
T17F761203FF5AD49AC4F78B33D9B1513241866E558B83D2471858B3BD297BEF08A4ABC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

33500752b0edbd6e1ba65b3bd29df8e71b6af42f0ab9cbc617d8b6e1095c39d1

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Facebook Corporation,OU=Facebook,O=Facebook Mobile,L=Palo Alto,ST=CA,C=US

baal.maze.wagling

android.permission.RECEIVE_SMS android.permission.CALL_PHONE android.permission.MODIFY_AUDIO_SETTINGS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_SETTINGS android.permission.DISABLE_KEYGUARD android.permission.RECEIVE_BOOT_COMPLETED android.permission.ACCESS_NOTIFICATION_POLICY android.permission.READ_SMS android.permission.REQUEST_DELETE_PACKAGES android.permission.ACCESS_MEDIA_LOCATION android.permission.KILL_BACKGROUND_PROCESSES android.permission.PACKAGE_USAGE_STATS android.permission.CAMERA android.permission.QUERY_ALL_PACKAGES android.permission.PROCESS_OUTGOING_CALLS android.permission.RECORD_AUDIO android.permission.INTERNET android.permission.READ_CONTACTS android.permission.MANAGE_ACCOUNTS android.permission.READ_CALL_LOG android.permission.REQUEST_INSTALL_PACKAGES android.permission.USE_EXACT_ALARM android.permission.READ_PRECISE_PHONE_STATE android.permission.ACCESS_WIFI_STATE android.permission.WRITE_SECURE_SETTINGS android.permission.SEND_SMS android.permission.POST_NOTIFICATIONS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.SCHEDULE_EXACT_ALARM android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.USE_BIOMETRIC android.permission.FOREGROUND_SERVICE android.permission.READ_PHONE_NUMBERS android.permission.WRITE_CONTACTS android.permission.SYSTEM_ALERT_WINDOW android.permission.WAKE_LOCK android.permission.MANAGE_EXTERNAL_STORAGE android.permission.USE_FULL_SCREEN_INTENT android.permission.GET_ACCOUNTS com.google.android.c2dm.permission.RECEIVE

baal.maze.wagling.cAhzP23OTgDwT

android.provider.Telephony.SMS_RECEIVED android.intent.action.USER_PRESENT android.intent.action.BOOT_COMPLETED android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.net.conn.CONNECTIVITY_CHANGE android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED android.intent.action.PACKAGE_ADDED

baal.maze.wagling.OS8XnxuETjd3MdsQ

android.provider.Telephony.SMS_DELIVER

baal.maze.wagling.zp7RcDV4gQnyMl6xF

android.provider.Telephony.WAP_PUSH_DELIVER

baal.maze.wagling.DeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED android.app.action.PROFILE_PROVISIONING_COMPLETE android.app.action.PROFILE_OWNER_CHANGED android.app.action.DEVICE_OWNER_CHANGED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

TikTok18.apk

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.INTERNET

Sharing

General

Malware Config

Signatures

File Explorer

TikTok18.apk

File Signature issue

biz.sport.slender.Eputvarious

base.apk

File Signature issue

baal.maze.wagling.uWU5

baal.maze.wagling.zjuggxTxqSRudBPVQ

baal.maze.wagling.EK

baal.maze.wagling.LOlwfgWTVMMyJOH

baal.maze.wagling.D426n0PzLvC6ravCIAd

baal.maze.wagling.Df

baal.maze.wagling.jduY62gTAaZpcK

baal.maze.wagling.StubActivity

com.google.android.gms.common.api.GoogleApiActivity

baal.maze.wagling.KAbULQmj67rOCZU9

baal.maze.wagling.dcQ_YhAG_JPQfyHte5

baal.maze.wagling.C_cO91YGAvdjDtEie

baal.maze.wagling.mYQOtZoJhf48oK

baal.maze.wagling.OIg6P5di0

baal.maze.wagling.PushService

baal.maze.wagling.SoftKeyboardService

baal.maze.wagling.VpnService

baal.maze.wagling.FirebaseMessagingService

baal.maze.wagling.RemoteService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

baal.maze.wagling.cAhzP23OTgDwT

baal.maze.wagling.OS8XnxuETjd3MdsQ

baal.maze.wagling.zp7RcDV4gQnyMl6xF

baal.maze.wagling.DeviceAdminReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

TikTok18.apk