trickmo | 11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d

Analysis

max time kernel
149s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
17/10/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d.apk
Size 8.5MB
Sample241017-bgl34atdph
SHA256 11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d
MD5 4ac484f345acdf8890166cbfeaa83768
SHA1 dc2e2796fabb883ca0c78248bb9c04ed1011f3a9
SHA512 98baff804466a3b02a9e1b333f58018664369f054cd5ae21869527ba63e0527e1b40e4b4edadd41abb2a34a244f6d49b0b6d827f29fdd6d9b89c63009ae1dd34
SSDEEP 196608:nHEhsSiVt8gibdDYcAIUGVwrAWH5PVc78KSg:nHc/irIDYAUGVgAWH9O78K9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://starnow.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/consnews.matt960.can/app_erase/MAtN.json	4297	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes2.dex	4297	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes3.dex	4297	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes4.dex	4297	consnews.matt960.can

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	consnews.matt960.can

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	consnews.matt960.can

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	consnews.matt960.can

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	consnews.matt960.can

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	consnews.matt960.can

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	consnews.matt960.can

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	consnews.matt960.can

consnews.matt960.can
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

MAtN.json

Path /data/data/consnews.matt960.can/app_erase/MAtN.json
Size 5.1MB
SHA256 5e3feb133a56c075ce9cb3f8dbe3ab445fd9541884a6712418c5d007e73a3aaa
MD5 45bd2884cc0cf2d05b1b78cff9ae11b4
SHA1 e8e29baabf5b0aad58475d9681abb49a05bdbd9d
SHA512 4d3f33d46adf49ea5ead847f392a1436e9ec5b14f47f1d90f86b0c8b25fce20b0d35ab0724c884e9a9c11c4c49ee043961bff817b70270d7beb250c9702ff640
SSDEEP 98304:5DtYvwR9I1NpB/85MtGmyW529S3FUiabLrRgHmV3pUVGhx7KCcu+F:DiQ61710MAmyW529AC9HnVCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAtN.json

Path /data/data/consnews.matt960.can/app_erase/MAtN.json
Size 5.1MB
SHA256 06a282bfd0d0b8e6f3e236650faa1bd13b54cb112f7748d0763b8031d2ae6621
MD5 9550548fdae0a7b2c03acfc776431f5c
SHA1 ee10833e07a7384e4c656aefffa29799473b94f7
SHA512 ea3d500689888e39d8fb1b6697b8c601f3cdacd304b12db176418b38ab95b04235337e0da734f12a6724d655d23edd437de3efa822df98712be308b9a6382b0e
SSDEEP 98304:k/Ky/vFrqv+bVm4BjKydL3Npq+ytvJNi+liIdhfVwzUMZpwHxxo3rY7sBFFftHyO:k/5/vFru+skjKOxUvJw+lRrfqAUWHxxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/consnews.matt960.can/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/consnews.matt960.can/databases/a
Size 20KB
SHA256 5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923
MD5 91af32c14839a2828ca58297e0861362
SHA1 bd758cc0bb47b570da2061d4633aa998a87ed971
SHA512 9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7
SSDEEP 6:l9bNFlq4yl18y4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLm8yNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 512B
SHA256 7facc208ccfd029496e492ab449820c7aff838b53ad5291c55ffe370380d89d1
MD5 e22849b062ce389037f873eb1c1beb57
SHA1 c91343579022f59316bcfb787ca8e05a426b849b
SHA512 2b87fea0530218a44ebca14bbd8d6f9b50492f1b275a9f5df8304ddc3d1250c2e5bb730a5d21ac0437405c9294286389b226fd9892850b26546538f6abf5efed
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 8KB
SHA256 ab33be9f057d69495290ba28e560a75db7963f2393b5889d39f677c4dbe9927e
MD5 c3d0ae44d758335954660d6a2e51046a
SHA1 2fcfcca5904f2e9a35f5cd4c790439e64363aebf
SHA512 d2ea9d8799929a15a84ceb8b31496a49d98f31de923dbe060705b8b12431a6bd1d9d9d20750492323232f19e0f4eef02e3c7d43c567ccf8429b89cbb67b391ad
SSDEEP 6:7+/l9qMn1Ug9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKd:7+tQFqLiuWd7RmBEyPbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 8KB
SHA256 8faad2d8553248aab1c234f85ec12a3041d6c9f98a553bdf229d82c57bac128b
MD5 134288f85fe342b697d7f37063f1121e
SHA1 04f66d7669d0227e2cd13e73d5238285c452506d
SHA512 26f909bc147f2ea6ff22d77cd5f3045fdf0e746996ff4ce8bf4f9231549803cb50ec87c2beb370823e76c59024795cd56bd93d8c45d8b9fe319f554ac2ec9fe1
SSDEEP 6:7+/l994Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKis//3:7+t8qLJdKBRmBEyPbTs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

consnews.matt960.can

Path /data/data/consnews.matt960.can/files/consnews.matt960.can
Size 256B
SHA256 1051ea7d72f098313e563567390355260197b32183e1f3e4bd878082a554a769
MD5 2e2c7bd388c98bbff5edaaef8679c527
SHA1 a8b92deeba4cfb37d3cfc5fd7f9e80dc2b9aabc0
SHA512 433c3d29ff6d5f74870a8fd23deaa4c8cc118eb711aa2ef3b6c78fc01d5adcf4db981287460669d116f5efd8bdd437af29e13c408266ba1f4d0984265f622e39
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 35cae00d26b855076cca2a699afbbdbbd60acff99981755a2c381c71a85a40c6
MD5 a0a8427b9f7b0e912b1ea08ef35eea60
SHA1 eb059849dcb76bccc4ac508b52cdbde036792336
SHA512 a0636dd129ac77359787a1b4613c70d4a48028eb11102f27775da2cffc3a665c19db615dc7e29a6dcb87f504061358341955450ce85552c62823558aca3e7a89
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 c2b78986dc61efd712c3837a70c53fa1d5a1d3325f1bf40ae18d04c1122c2ab8
MD5 f670bebdb361761efaf9c58eaaa45325
SHA1 d2df40e2fb9cf073a04e98bd6a82e53b0c9d76fe
SHA512 5a2bc1178d85a4dd3d2bf08fe61028220a888526ebc8b521e440fd85d6430ad14dccaa76e1f2111a94e413608726b5ca8dc68868aaf1e39d46c2b61a395ba339
SSDEEP 12:3PDt5sdhtMXrXDD9DzS0sn9J10dyFGKH6nQnFGKhSjDVOmbl9GVADYrFIKDt4tWC:YjtYZzr8V6QnGtJ6jredjtYGu7ZGIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 c86c17fd1a979b8612ff706bbf8574a8930e0820312fa929241a78950859c5bd
MD5 2986e810a12896929646d4450eb03a78
SHA1 001995e0c4ebdbc3b056ada8d9948c320f395326
SHA512 556565f9d5ff2355137ba59b12294a77f4f0666cce680383e1926e205900ad324f00d08463ffbe3b3a651c5138a9ec86dba7b54e42af6224562bbfce8d03a4d7
SSDEEP 6:KOO3Ws3egJ9FZdKEAlOERX4PBX4ogLugMBX4suuK+/0zAEkkvJ+UlEK/4Ow2:Kt3Ws3bXzdKBRmBEyPbP/ItRZlEKgOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 bf0880bcb68839b0d6c844ade1ccd8bb159df9a0ba7a1b05e962ab8c08acd38b
MD5 e031c638bc166aa6cf3ccdf0b40e9e45
SHA1 f9ab44c4a39b0271906d06cd512829dbfb301f4a
SHA512 ac304fa5d4be315ead0288799c042aff461a4fcd7f09e7081f79de6b3b4d0ad6faffcc5570e8ded2e2745e0298c4ffacc86a1bd8660bf9e39bfefb7a7cb8c3c3
SSDEEP 96:MkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPx/4d:fVdjnHt9Mpf8UzS5+TD8q0E5x/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAtN.json

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json
Size 11.1MB
SHA256 57b7c8e0879f6b3cd3bb169533f8069072322b178dd2efb8cedf5d77761e32e0
MD5 b2dd75b19e82fd1b6f8c1bbd80b00d43
SHA1 fbcc0c095a6951f1c268c3534e80182275cf56dd
SHA512 078089605d533d1d8dddae498383e79eb37275bb034666cfc5d2b2df13883f9fa417374f1461d091fe0d5d37d09a5d18a2f9c42228e72b68ac8dff01de380395
SSDEEP 98304:jIroDpilznK62kXbMg5jw0uyrLrWYOx3mwpN:ErVw0jvrKxVpN
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes2.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes2.dex
Size 354KB
SHA256 d69d7a5de42fd2219b81e57d5f4cd328e54f9efb9c98dc7977ecca30fea50abd
MD5 81f38c51436583b57b99da62a839ad7f
SHA1 3719a8aa29af2656ffb554863f3f4ff36039acce
SHA512 6d673091df3b7d2538fbe1da035847c88cdfd85eaf4243fd00917ed7335ebced008a24a9bf3c0ba2b71543998e23ea550dd9846d8ed78996d1c9420374630669
SSDEEP 6144:8sfp8AjF1t66i/eu4kElNZ/Lpa9T6Jm59nQ3mWDVc/ZfXlP761li8Jv5+:xGeNdt5PE
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes3.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes3.dex
Size 254KB
SHA256 c23054ed69284e961a6d6af8cf762cead12f720031fa527c6f28fe3168c01f81
MD5 e43a2e60e043ee737a1705cf8c36278a
SHA1 66a82c6d614798c5dde92788e974239765d9c366
SHA512 103d93ef3273f08cc8b94ea05fb79af5cf2ec51d6201722f44c2b3285f3f29dda1b251e818e65148f13833b627604f4f55a8a1ec1528da70ddf0a204893f0d76
SSDEEP 3072:pNXQcbmFAVTd3AUVd1LCwdKsDh9GJhmVo2nZ4BCVcDAcWYz+ijhIvTgYWq1GvETA:pNXQcbmFAHxLHd+mV7LckcPaijMTA1
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes4.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes4.dex
Size 1.9MB
SHA256 217bb9f5b5728b6373d10962cffa93c3b263049601ce4bfdc30f1b89c0e69c53
MD5 32579b28ea9ce1c5fa1f35bd4f9818bd
SHA1 8a262963232c8e2e43d755281f46ad7565e62a9f
SHA512 dfb21bbe5a06aa760e412d05e9a91dc14b44928b8f88e6e01f96bfbd3d9a6637c33e8cf5d02dddb038cbd8dba5dd0cc382debb31c66f8f7d6ce3f176b2a6873e
SSDEEP 24576:xfGUb+VwKV63d0EgawFAue4FJc19ZK7ALt3l/zO:xfGl63d07nc19ZKKtV/zO
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/consnews.matt960.can/cache/logs/log.txt
Size 153B
SHA256 ac758815d9325293a33aff341db641091fd66d2fe50501080f1ff768e63cffb2
MD5 f9bc8d4162503ea0baaecc9cc972289b
SHA1 8792eaac960c0efabd3ab79fca6b9d9c340a7151
SHA512 5ee456a31438867048cfdc4d30d596e8d14a72eeece7afc12c1478d83e5b8f6848a27cd5873e3ef2687f8676365057b508bfdfee98f07c64f416042f2d60c6e1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads