General
- Target 5c749c9fce8c41bf6bcc9bd8a691621b
- Size 815KB
- Sample240517-w129mscf54
- SHA256 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c
Score
10/10
Malware Config
Targets
-
- Target 5c749c9fce8c41bf6bcc9bd8a691621b
- Size 815KB
- SHA256 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c
Score10/10-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal
Application may abuse the framework's APIs to prevent removal.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Queries the phone number (MSISDN for GSM devices)
-
Registers a broadcast receiver at runtime (usually for listening for system events)
-
Requests enabling of the accessibility settings.
-
Acquires the wake lock
-
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2