S0558 Tiktok Pro
Tiktok Pro is spyware that has been masquerading as the TikTok application.1
| Item | Value |
|---|---|
| ID | S0558 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.0 |
| Created | 05 January 2021 |
| Last Modified | 19 April 2021 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| mobile | T1429 | Audio Capture | Tiktok Pro can capture audio from the device’s microphone and can record phone calls.1 |
| mobile | T1623 | Command and Scripting Interpreter | - |
| mobile | T1623.001 | Unix Shell | Tiktok Pro can execute commands .1 |
| mobile | T1533 | Data from Local System | Tiktok Pro can collect device photos and credentials from other applications.1 |
| mobile | T1624 | Event Triggered Execution | - |
| mobile | T1624.001 | Broadcast Receivers | Tiktok Pro has registered for device boot, incoming, and outgoing calls broadcast intents.1 |
| mobile | T1420 | File and Directory Discovery | Tiktok Pro can list all hidden files in the /DCIM/.dat/ directory.1 |
| mobile | T1541 | Foreground Persistence | Tiktok Pro has shown a persistent notification to maintain access to device sensors.1 |
| mobile | T1628 | Hide Artifacts | - |
| mobile | T1628.001 | Suppress Application Icon | Tiktok Pro can hide its icon after launch.1 |
| mobile | T1630 | Indicator Removal on Host | - |
| mobile | T1630.002 | File Deletion | Tiktok Pro can delete attacker-specified files.1 |
| mobile | T1417 | Input Capture | - |
| mobile | T1417.002 | GUI Input Capture | Tiktok Pro can launch a fake Facebook login page.1 |
| mobile | T1430 | Location Tracking | Tiktok Pro can track the device’s location.1 |
| mobile | T1636 | Protected User Data | - |
| mobile | T1636.002 | Call Log | Tiktok Pro can collect the device’s call logs.1 |
| mobile | T1636.003 | Contact List | Tiktok Pro can access the device’s contact list.1 |
| mobile | T1636.004 | SMS Messages | Tiktok Pro can collect SMS messages from the device.1 |
| mobile | T1603 | Scheduled Task/Job | Tiktok Pro has contained an alarm that triggers every three minutes and timers for communicating with the C2.1 |
| mobile | T1513 | Screen Capture | Tiktok Pro can take screenshots.1 |
| mobile | T1582 | SMS Control | Tiktok Pro can send SMS messages.1 |
| mobile | T1418 | Software Discovery | Tiktok Pro can obtain a list of installed applications.1 |
| mobile | T1426 | System Information Discovery | Tiktok Pro can check the device’s battery status.1 |
| mobile | T1512 | Video Capture | Tiktok Pro can capture photos and videos from the device’s camera.1 |