Analysis
- max time kernel
178s - max time network
184s - platform
android_x64 - resource
android-x64-arm64-20240514-en - resource tags
- submitted
17/05/2024, 18:24
General
- Target 5c749c9fce8c41bf6bcc9bd8a691621b.apk
- Size 815KB
- Sample240517-w129mscf54
- SHA256 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c
Score
10/10
Malware Config
Signatures
- TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Requests enabling of the accessibility settings. 1 IoCs
- Acquires the wake lock 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
d2.d2.d21⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
a
a-journal
a-journal
a-journal
d2.d2.d2