Analysis

  • max time kernel
    540s
  • max time network
    611s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260721-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system
  • submitted
    23/09/2026, 19:14

General

  • Target
    TikTok-Lite.apk
  • Size 17.3MB
  • Sample260923-xx2dlsaf32
  • SHA256 31cacd625f62ba6c62f9fb49c393ca0c1f1b05f4b89bd49a0df3117099ecec19
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.zhiliaoapp.musically.go
    1⤵
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:3242

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PcfKJOBvbYHadA7ye-GQbonzRZs.1662315042292187175.tmp

        • Path /data/data/com.zhiliaoapp.musically.go/cache/image_cache/v2.ols100.1/76/PcfKJOBvbYHadA7ye-GQbonzRZs.1662315042292187175.tmp
        • Size 36KB
        • SHA256 a7008fb144a28e185f19162baa5408922193847c55d042fa67e21468641ee89f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _FXVGIGgq2Z5l4TAxWKb_FKiV34.6248287379949770620.tmp

        • Path /data/data/com.zhiliaoapp.musically.go/cache/image_cache/v2.ols100.1/84/_FXVGIGgq2Z5l4TAxWKb_FKiV34.6248287379949770620.tmp
        • Size 2KB
        • SHA256 0abd4b65a9a75900b06071bedb3720325b12f6c261934292630b50a0e77cfb46
        • MD5 SHA1 SHA512 TLSH

        base.3242.tmp

        • Path /data/data/com.zhiliaoapp.musically.go/cache/oat_primary/x86_64/base.3242.tmp
        • Size 32KB
        • SHA256 ad40dd144b2b38e65df824333116ddbc43a10907b16e0fff683ef107d839313d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db
        • Size 36KB
        • SHA256 92a68af7682f057d4c6407fd91b39f5304b6bd7e904c86111e4ff1a5dd33a2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 512B
        • SHA256 3d6f27624adcdfe138d7352a1e8a5b8b66d86d2270c4d9559ef3cc1d8ac39c36
        • MD5 SHA1 SHA512

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 8KB
        • SHA256 122ec3c1635e6a087a194426256a1910696a2b207edc3a1f9f34f0f5f9cd38e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 8KB
        • SHA256 f08e04f498fa5dc1bbacb25d95e2729d0ea85e8144da52bb117b9bdde3f259eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 16KB
        • SHA256 7c1f54fba1e94bef88e4aa33668785507a5f8edfe6b3147c6832f0f89beeb191
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 20KB
        • SHA256 3c26fef6fe6eae7f3f5afc67fec355d13c06b883abe4b67364a227373711252d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psdkmon_v2.db-journal

        • Path /data/data/com.zhiliaoapp.musically.go/databases/psdkmon_v2.db-journal
        • Size 24KB
        • SHA256 c15a8457ae275d017f4fe72a0eec3d0891b57ca37006f0a58d06b963f309a767
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1790270834885

        • Path /data/data/com.zhiliaoapp.musically.go/files/AFRequestCache/1790270834885
        • Size 3KB
        • SHA256 5c6f777ad314dc9ff7c78866fb6a7697408df42dafa4ca209c8336495de275b7
        • MD5 SHA1 SHA512 TLSH

        classes_all.zip

        • Path /data/data/com.zhiliaoapp.musically.go/files/edex-extract/classes_all.zip
        • Size 2.2MB
        • SHA256 437a1cf9677a4058303fc79cb7bf45281ad8be3e42db739dcf47721a43abb6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tt_dex.zoin_load.log

        • Path /data/data/com.zhiliaoapp.musically.go/files/esolib/arm64-v8a/tt_dex.zoin_load.log
        • Size 3KB
        • SHA256 025ee0c919e9b3a2d141f6afdf0919682bf7f13565f405c85c80680cff4426b4
        • MD5 SHA1 SHA512 TLSH

        tt_lib.zoin_load.log

        • Path /data/data/com.zhiliaoapp.musically.go/files/esolib/arm64-v8a/tt_lib.zoin_load.log
        • Size 2KB
        • SHA256 e6bd596ef5976b618edb3a09494e4927a261392e78a7309d70f704d3294db563
        • MD5 SHA1 SHA512 TLSH

        1790270815059.aif

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/general/1790270815059.aif
        • Size 539B
        • SHA256 814a76749c7f51baa266d745ae043d22e12e1b1fd717cc080343b5dd66627661
        • MD5 SHA1 SHA512 TLSH

        current.aid

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/params/current.aid
        • Size 133B
        • SHA256 a6d23cbee3814a87a7d22f612871f0f3473bb8ba586e5cec7ad580282a866432
        • MD5 SHA1 SHA512 TLSH

        current.chn

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/params/current.chn
        • Size 147B
        • SHA256 6995292820c0d7982f6162180e09bd1c73b11479c70458695f5e3754c3ef30fb
        • MD5 SHA1 SHA512 TLSH

        current.did

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/params/current.did
        • Size 129B
        • SHA256 c2aeaee1379b0ca8c1834433e9d03bc1d3c50c0d78fd6002e00edf74156505db
        • MD5 SHA1 SHA512 TLSH

        current.ver

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/params/current.ver
        • Size 212B
        • SHA256 5e4ff08c4de6e1fb328b3a4b761b1d1152e8a8e6902fb5037fea33fbe93cd6ae
        • MD5 SHA1 SHA512 TLSH

        com_zhiliaoapp_musically_go.times

        • Path /data/data/com.zhiliaoapp.musically.go/files/npth/uploadLimits/com_zhiliaoapp_musically_go.times
        • Size 14B
        • SHA256 6df5562498360120d8f6250e2f47d672625add4046a8d57bf884011bda22e560
        • MD5 SHA1 SHA512

        profileInstalled

        • Path /data/data/com.zhiliaoapp.musically.go/files/profileInstalled
        • Size 24B
        • SHA256 e115482a1e42283e9be17040fc5b1ac84d268515814296e97618c7f35bd488cf
        • MD5 SHA1 SHA512
        • Path /data/data/com.zhiliaoapp.musically.go/oat/x86_64/[email protected]
        • Size 156B
        • SHA256 a57e9704af61e99b047a739ec9f3ef8ed923e13b9bfe78cb56fb01d104c4e25d
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zhiliaoapp.musically.go/oat/x86_64/[email protected]
        • Size 304B
        • SHA256 c91434f87b50bdc13d643113cf026edfff567602dc6f9d6a49ff6446ed70a914
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zhiliaoapp.musically.go/oat/x86_64/[email protected]
        • Size 156B
        • SHA256 c04c7d22f5b194ea0c8b1e2f48b66f222c83a8e2cfaf1677136cb9fc710a6aa6
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zhiliaoapp.musically.go/oat/x86_64/[email protected]
        • Size 168B
        • SHA256 0b48a7ef5c98cb2ed4b0d71a5bdb4ba95699ce99d5539ba3e83cd3a0180fa883
        • MD5 SHA1 SHA512 TLSH

        ezoin-sp.xml

        • Path /data/data/com.zhiliaoapp.musically.go/shared_prefs/ezoin-sp.xml
        • Size 391B
        • SHA256 d7892e9128deae9c96e35e17c325ef98483817d2b6736c71fbe5891273a18021
        • MD5 SHA1 SHA512 TLSH

        ttnet_tnc_config.xml

        • Path /data/data/com.zhiliaoapp.musically.go/shared_prefs/ttnet_tnc_config.xml
        • Size 138KB
        • SHA256 bf7ba75191f0f008ce07d6e04b7a125aa0e50f7157c865de4ea300366b4598a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof.FjWcsN.tmp

        • Path /data/misc/profiles/cur/0/com.zhiliaoapp.musically.go/primary.prof.FjWcsN.tmp
        • Size 340B
        • SHA256 32e22448ec16a039593c408e349196c4b7ca976eefdf13f948257423f26f8606
        • MD5 SHA1 SHA512 TLSH

        anon_inode:[eventfd]

        • Path anon_inode:[eventfd]
        • Size 8B
        • SHA256 7c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
        • MD5 SHA1 SHA512