General
- Target dicktok.apk
- Size 25.9MB
- Sample260807-phyp6sfg64
- SHA256 418c2c4ce0150d073dfb21ef01d7074088058880214d8a547dcec28987730144
- MD5 47778359e528d684aa1bb8cbf572760b
- SHA1 2a95d2d32297953ea6c11bf415ccfcd24ed184ef
- SHA512 1b96c0963a109afc225302bf5b6625e55e56c21e5a10fd8b9de3f53c60c46d940a6060f23e83047db29717849aff16fe573c7b5f693cfacdf7271fdd240931d6
- SSDEEP 786432:LDV9zA/WkNNyNevXTH4POGZRCpYz13HytHSPxdSi:LDV9U/JNoNeLH4POGZRCpYx3Hyhw3
- TLSH T13E573399A3E55A3FECB789754EE8831967448F548ECAC2A79280331C5C3B9D5CE21EC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
dicktok.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
dicktok.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
dicktok.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
core.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral5
Sample
core.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral6
Sample
core.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target dicktok.apk
- Size 25.9MB
- SHA256 418c2c4ce0150d073dfb21ef01d7074088058880214d8a547dcec28987730144
- MD5 47778359e528d684aa1bb8cbf572760b
- SHA1 2a95d2d32297953ea6c11bf415ccfcd24ed184ef
- SHA512 1b96c0963a109afc225302bf5b6625e55e56c21e5a10fd8b9de3f53c60c46d940a6060f23e83047db29717849aff16fe573c7b5f693cfacdf7271fdd240931d6
- SSDEEP 786432:LDV9zA/WkNNyNevXTH4POGZRCpYz13HytHSPxdSi:LDV9U/JNoNeLH4POGZRCpYx3Hyhw3
- TLSH T13E573399A3E55A3FECB789754EE8831967448F548ECAC2A79280331C5C3B9D5CE21EC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC)
-
- Target core.apk
- Size 8.9MB
- SHA256 cb965d04486425ecf1739432a1a7f32929c4706d799cef9ef63b3003d95e13cc
- MD5 79ebf12c7003f39560a80510ae4f268e
- SHA1 8d4b0fb3fdee4615dccf685542cf0786565ada48
- SHA512 5175d2cf9452e138a8cf9ab1ee954acc13d8c40092869443f51a1fa2b0888e99773f1fe0f5d6766dfe7200ce1edd69f5867e754d7a071b8625624b69ed721543
- SSDEEP 98304:JfDyEJloANv7OZzgTmTufK62g48GKsJZx6xedu:JfDyEJSfZzgNKDJZ40u
- TLSH T16796BE53F7018C33C31E8A7569FB7304BB315266A613CB532504B6A8FCD36E9A68D6C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Checks the application is allowed to request package installs through the package installer
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
1System Checks
1