trickmo | 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c

General

Target
5c749c9fce8c41bf6bcc9bd8a691621b.apk
Size 815KB
Sample240517-w129mscf54
SHA256 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c
MD5 5c749c9fce8c41bf6bcc9bd8a691621b
SHA1 d6691a049f44bb101bd596826a7741792f8e20d8
SHA512 1a526801f3346eea67cdae2f37ec7c640ef6a70c91bd378f9bb9807bba96138352172402f834b11b29f64928e863fc1a1018c9c2ed0565ed39ab43f78fc13470
SSDEEP 12288:CD0vImbHM9EoLWb0zNzH9MR+kqHaRaDHqdEgfWvGPgKyNUBhs6:1vImbs9vN+9qHaRkiFevGPgvqBhs6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	d2.d2.d2

Prevents application removal 1 TTPs 1 IoCs

Application may abuse the framework's APIs to prevent removal.

evasion

Prevent Application Removal

T1629.001

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	d2.d2.d2

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	d2.d2.d2

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	d2.d2.d2

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	d2.d2.d2

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	d2.d2.d2

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	d2.d2.d2

d2.d2.d2
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4268

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

a

Path /data/data/d2.d2.d2/databases/a
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/d2.d2.d2/databases/a-journal
Size 512B
SHA256 5dfb9b77fba4bfb0ea0d4514b7e417843c62ed6595e480495288f9bbbab2d176
MD5 44c07d1b1482a38cd07964b93d8827c4
SHA1 eb55445ff644fc1b78f406e3d0a627dc88288056
SHA512 077bb5488c52fd0dd04d9a0005a89f80ac29ef564e2397d6b6d7abda1b5d5c831960a85a9f4165dc672c5776bd9b4e3e79ade05948824e529d1857bd5495a90d
MD5 SHA1 SHA512

Submit Download

a-shm

Path /data/data/d2.d2.d2/databases/a-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-wal

Path /data/data/d2.d2.d2/databases/a-wal
Size 32KB
SHA256 e8836c15057c045b53d5d729871a44fd11217869fd16e46619886ff33a96f17d
MD5 d8904db8ec9459a493d7b0d344b33fa0
SHA1 213270254443cec3552cf0618ce212ddbb985b0c
SHA512 ed663b2c8f851452a4f37572b72ea59214179888015964c43d36435e8539ead697e0165b60eea13bbc3f505cf3fb5f48742d58953463d185550e86b3e3e9df9d
SSDEEP 12:KNn/zdTRmBEyPbP/Pf547ft7S1OwClqWQDqyNTSFbyiyuE9dMARmBEyPbP/PdvPx:KNn/zyGSP/PBrx/WQTEPjGSP/Pdvbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

d2.d2.d2

Path /data/data/d2.d2.d2/files/d2.d2.d2
Size 256B
SHA256 2db31a744a679d575ea304c43919ae57261f7577555ad87ac0f8e22d64da0930
MD5 915c984afa227bc09875d52c10341a69
SHA1 ec034df50f35d20c00a73be94814220609480868
SHA512 dbc925fcef15b24d27e02225e431df94d2105866ed386729a474f15942ed489992455215c29f95c7ca0a8d6c42d54ff23b32c61e975171e10204d36fa8895ac0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads