Analysis

  • max time kernel
    63s
  • max time network
    180s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    21/06/2026, 04:37

General

  • Target
    TikTok_You-3.0-(45.5.3).apk
  • Size 467.6MB
  • Sample260621-e8256scv3s
  • SHA256 051691c1562d0b6b066a96843f5c309dae0d6f0e8d102945e84ed71eb8cfe11e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.zhiliaoapp.musically
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:3382
  • com.zhiliaoapp.musically:jobInfoSchedulerService
    1⤵
    • Queries information about active data network
    PID:3634

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cookies-journal

        • Path /data/data/com.zhiliaoapp.musically/app_webview/Default/Cookies-journal
        • Size 512B
        • SHA256 3d5f5936365097a270cce03e24340b6197211632f680de1bb8e827a424ebd7c4
        • MD5 SHA1 SHA512

        Cookies-journal

        • Path /data/data/com.zhiliaoapp.musically/app_webview/Default/Cookies-journal
        • Size 8KB
        • SHA256 2cd9dba19b9f454b299d3c50b8e33ac6278e358d9287b445a1079cc373455ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 77d467c3d4a265b97080943824f11e8232614449adee50449ce2dd594add9216
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 6906b672b48a2fc19911e5573fe3f60dfe8deffcefc10440ab90bb386741c3dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 c527fcbef6b579a0b91b24f37b526f58fcb54a0f93d052ff6ac082e69650694c
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 fa9887016e1970a485d22f1238c12e00297cce259c4efc9b2bc06a3224517fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 dc24545d44ada43c7c7acbffbf8e13e33ceb93efd68e369187c7bd6b29b4b37f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 46548273ec73a1fa1dc5d34af13a5a7c5459a6f44c76672b8f90d819eecb6964
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 c74bd0b0a3a576f2601473cdcf811ae6731ca4ff7ada1362f22637f9cdbd96eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 2a5c5510ea9a46ae79687a21fafb35b34f09497656e3dfccf38902dd6b3330e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 8cd219204aec3e10a56f6bd80ffba8cf0121e91d896a151d4af97fdaf03805c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 153e2593c1800063bc13b5366a9a28253093f4e574fafcda128bb6b00c2c3f32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        share.db

        • Path /data/data/com.zhiliaoapp.musically/databases/share.db
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH

        share.db-journal

        • Path /data/data/com.zhiliaoapp.musically/databases/share.db-journal
        • Size 512B
        • SHA256 41926682b139f1fc78be21cc91e3da5acdd1b1502a3a78070e71fa672eca249a
        • MD5 SHA1 SHA512

        share.db-shm

        • Path /data/data/com.zhiliaoapp.musically/databases/share.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        share.db-wal

        • Path /data/data/com.zhiliaoapp.musically/databases/share.db-wal
        • Size 16KB
        • SHA256 ff8f18594733b4eaf416b1c8366c12f6d9d12abf6bc3b552a9262fd2eabb2b79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        share.db-wal

        • Path /data/data/com.zhiliaoapp.musically/databases/share.db-wal
        • Size 36KB
        • SHA256 48e24a446272f815997f9642d66f552294242bdaab820feed6b884f0273723da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation6722015067710856929tmp

        • Path /data/data/com.zhiliaoapp.musically/files/PersistedInstallation6722015067710856929tmp
        • Size 90B
        • SHA256 5d504d7748de02b46f083a05471c0d352108a1e0f2540c2bf2482577e5f8c8a8
        • MD5 SHA1 SHA512 TLSH

        machine.json

        • Path /data/data/com.zhiliaoapp.musically/files/machine/machine.json
        • Size 170B
        • SHA256 7504c3974bcc25b7981e862c63e467e7e95de04fd508ca92f0796e9094d9f8fd
        • MD5 SHA1 SHA512 TLSH

        machine.json

        • Path /data/data/com.zhiliaoapp.musically/files/machine/machine.json
        • Size 183B
        • SHA256 a803056b8ba5c1c77203a81d2462a7e470d0320e98021f3db878567cfa0f088a
        • MD5 SHA1 SHA512 TLSH

        machine.json

        • Path /data/data/com.zhiliaoapp.musically/files/machine/machine.json
        • Size 219B
        • SHA256 546a3f4dc320925f20c73155ccf7fbdaf63b8e0acd1fcdc366be7f6e21cb2636
        • MD5 SHA1 SHA512 TLSH

        2010.config

        • Path /data/data/com.zhiliaoapp.musically/files/npth/configs/2010.config
        • Size 4KB
        • SHA256 581848b3d904ed6f2a4a45450cff66623fb539160fa38f2c74153c6559ae5f91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        common_params.json

        • Path /data/data/com.zhiliaoapp.musically/files/npth/crash/1782017132582-3382/common_params.json
        • Size 1011B
        • SHA256 c227be8770c914997466fba0cb5877a700c6fbfedfbd6fd640d070c8499a1caf
        • MD5 SHA1 SHA512 TLSH

        locale.inf

        • Path /data/data/com.zhiliaoapp.musically/files/npth/crash/1782017132582-3382/locale.inf
        • Size 125B
        • SHA256 a54f80bc3548eb9dc39d312038e7786593debf282c6a437faeb5af41aa4e5d0f
        • MD5 SHA1 SHA512 TLSH

        1782017122384.aif

        • Path /data/data/com.zhiliaoapp.musically/files/npth/general/1782017122384.aif
        • Size 688B
        • SHA256 b9103b42ad62f4d2343bac4304451173874ef713e248f1c13fc1328b7035b6c7
        • MD5 SHA1 SHA512 TLSH

        rom.inf

        • Path /data/data/com.zhiliaoapp.musically/files/npth/general/rom.inf
        • Size 332B
        • SHA256 3ccd29cf83cbe9a15dde955fc8edac09fc944e2658217d2f574b32c602f9baac
        • MD5 SHA1 SHA512 TLSH

        current.aid

        • Path /data/data/com.zhiliaoapp.musically/files/npth/params/current.aid
        • Size 133B
        • SHA256 2c2a8ad3d8be855aec2f4c478d5bbbf7d0b6eeb3317e8b5d4512ed1e0d4a83e2
        • MD5 SHA1 SHA512 TLSH

        current.chn

        • Path /data/data/com.zhiliaoapp.musically/files/npth/params/current.chn
        • Size 139B
        • SHA256 9fea958debd92f78d04c82750d84cbc03643bb9278947929604e28d98207ffcb
        • MD5 SHA1 SHA512 TLSH

        current.did

        • Path /data/data/com.zhiliaoapp.musically/files/npth/params/current.did
        • Size 129B
        • SHA256 9bf2eba13ac239d54f5acfad4e97c3efab053270bb051ada412ba367bbd16b4c
        • MD5 SHA1 SHA512 TLSH

        current.ver

        • Path /data/data/com.zhiliaoapp.musically/files/npth/params/current.ver
        • Size 211B
        • SHA256 21f9de2baf32ffad890efec37ff3bdc0994932a7924261a517aa7f65454a0a55
        • MD5 SHA1 SHA512 TLSH

        com_zhiliaoapp_musically.times

        • Path /data/data/com.zhiliaoapp.musically/files/npth/uploadLimits/com_zhiliaoapp_musically.times
        • Size 14B
        • SHA256 9f4fbae3cbd12d56d17c008b23b153b66e39f06be9273e30036d813afe203d48
        • MD5 SHA1 SHA512

        zoin_load.log

        • Path /data/data/com.zhiliaoapp.musically/files/zoin/c3805a282ea29ffd_arm64_v8a/zoin_load.log
        • Size 7KB
        • SHA256 8862968848a094367f779a414ff63c2a5dad832b6ff325bdd004764dced8f401
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CLIENT_EXPERIMENT_CACHE_TAG.xml

        • Path /data/data/com.zhiliaoapp.musically/shared_prefs/CLIENT_EXPERIMENT_CACHE_TAG.xml
        • Size 376B
        • SHA256 25429defe7004e916d9ca75d4e2a66faac3892d89143e39987d5ed34b97539c2
        • MD5 SHA1 SHA512 TLSH

        aweme-app.xml

        • Path /data/data/com.zhiliaoapp.musically/shared_prefs/aweme-app.xml
        • Size 120B
        • SHA256 080d0a4422b66349430de81fc78e429b4a2eba3871a9b587a6bba143a4e426de
        • MD5 SHA1 SHA512 TLSH

        anon_inode:[eventfd]

        • Path anon_inode:[eventfd]
        • Size 8B
        • SHA256 7c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
        • MD5 SHA1 SHA512

        anon_inode:[eventfd]

        • Path anon_inode:[eventfd]
        • Size 1.6MB
        • SHA256 54012401530f204ce3365c777cdf495470d2e8e3d22e5f490cc62acbe101da95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        socket:[23790]

        • Path socket:[23790]
        • Size 59B
        • SHA256 d11c538db1d5e387dfbc0bd2fb2e628d2a5410320da3637bf447e616aae94588
        • MD5 SHA1 SHA512 TLSH

        socket:[26035]

        • Path socket:[26035]
        • Size 58B
        • SHA256 ddc1336c856b256dfbec500f434bf5cdd15f974b6504aeaa605e303b6b7c59f8
        • MD5 SHA1 SHA512 TLSH