trickmo | 11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d

Resubmissions

14/01/2025, 18:45

250114-xej2lsxqer10

14/01/2025, 18:42

250114-xcrzfawjes10

14/01/2025, 18:34

250114-w774gaxpbp10

19/10/2024, 16:41

241019-t67efayanq10

Analysis

max time kernel
131s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
19/10/2024, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d.apk
Size 8.5MB
Sample241019-t67efayanq
SHA256 11af0da9a7c5f65bb098ed52973e814b12eba492fb3615a5fada5d4cc390928d
MD5 4ac484f345acdf8890166cbfeaa83768
SHA1 dc2e2796fabb883ca0c78248bb9c04ed1011f3a9
SHA512 98baff804466a3b02a9e1b333f58018664369f054cd5ae21869527ba63e0527e1b40e4b4edadd41abb2a34a244f6d49b0b6d827f29fdd6d9b89c63009ae1dd34
SSDEEP 196608:nHEhsSiVt8gibdDYcAIUGVwrAWH5PVc78KSg:nHc/irIDYAUGVgAWH9O78K9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://starnow.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/consnews.matt960.can/app_erase/MAtN.json	4338	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes2.dex	4338	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes3.dex	4338	consnews.matt960.can
/data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes4.dex	4338	consnews.matt960.can

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	consnews.matt960.can

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	consnews.matt960.can

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	consnews.matt960.can

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	consnews.matt960.can

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	consnews.matt960.can

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	consnews.matt960.can

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	consnews.matt960.can

consnews.matt960.can
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4338

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

MAtN.json

Path /data/data/consnews.matt960.can/app_erase/MAtN.json
Size 5.1MB
SHA256 5e3feb133a56c075ce9cb3f8dbe3ab445fd9541884a6712418c5d007e73a3aaa
MD5 45bd2884cc0cf2d05b1b78cff9ae11b4
SHA1 e8e29baabf5b0aad58475d9681abb49a05bdbd9d
SHA512 4d3f33d46adf49ea5ead847f392a1436e9ec5b14f47f1d90f86b0c8b25fce20b0d35ab0724c884e9a9c11c4c49ee043961bff817b70270d7beb250c9702ff640
SSDEEP 98304:5DtYvwR9I1NpB/85MtGmyW529S3FUiabLrRgHmV3pUVGhx7KCcu+F:DiQ61710MAmyW529AC9HnVCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAtN.json

Path /data/data/consnews.matt960.can/app_erase/MAtN.json
Size 5.1MB
SHA256 06a282bfd0d0b8e6f3e236650faa1bd13b54cb112f7748d0763b8031d2ae6621
MD5 9550548fdae0a7b2c03acfc776431f5c
SHA1 ee10833e07a7384e4c656aefffa29799473b94f7
SHA512 ea3d500689888e39d8fb1b6697b8c601f3cdacd304b12db176418b38ab95b04235337e0da734f12a6724d655d23edd437de3efa822df98712be308b9a6382b0e
SSDEEP 98304:k/Ky/vFrqv+bVm4BjKydL3Npq+ytvJNi+liIdhfVwzUMZpwHxxo3rY7sBFFftHyO:k/5/vFru+skjKOxUvJw+lRrfqAUWHxxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/consnews.matt960.can/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/consnews.matt960.can/databases/a
Size 20KB
SHA256 5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923
MD5 91af32c14839a2828ca58297e0861362
SHA1 bd758cc0bb47b570da2061d4633aa998a87ed971
SHA512 9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7
SSDEEP 6:l9bNFlq4yl18y4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLm8yNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 512B
SHA256 7f493e2dec191a9964b8e9a22c2582619a45e67dc57277e20b95af134730ca7a
MD5 cbeb20fceac38da719d390f39f7cd39b
SHA1 1a4468e81b680258665a94c9349696ff48b386de
SHA512 f862ba663ca2eb39f6a54106738a8ff985c6ecec13d208d27803f9ade9198e47b5d581a94c42d1a20e8f2f2d2b2e9399797308b908f5de4c9192789b8a57e5cf
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 8KB
SHA256 a0ef4898bc58d831772b0dd7e95fa5ad2f968ba3932e1ecabe0d6d2497d08b1c
MD5 27e9819daf1ba110bcdf3f60fe894368
SHA1 0733412186262c8ebd2ef5e9cac60cc26d1dacc2
SHA512 50e370f8bfd7702fb82d1e87ce23460651ec812cae0f29d2bedb120ff680ff71bc092bf79bce770ae4770397dbfad1dba067726b0ce43d77ac0005c274d4485a
SSDEEP 6:7+/l9SE6On1qlg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKLn:7+tUZqLiuWd7RmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/consnews.matt960.can/databases/a-journal
Size 8KB
SHA256 84a04bbb3a188b8235bdee468f4b90c933ba5af4d3fbe55bda903fc8eec7f996
MD5 01daf3ceda794099ae4403f7e408cd3f
SHA1 f614c7e67041519648c606662b29cb28c6762122
SHA512 8e597f3d2ed82faac356f2b078dfd59c390ee3d92f9e19cae936918b6935ebdc42db7592f2834600b592b5dfa836a7816e9f10e7f383335b3bd3999b5fad4420
SSDEEP 6:7+/l9zPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKyf///w:7+t9qLJdKBRmBEyPbDfvw
MD5 SHA1 SHA512 SSDEEP

Submit Download

consnews.matt960.can

Path /data/data/consnews.matt960.can/files/consnews.matt960.can
Size 256B
SHA256 87ac0339172ee4e3ec523f94a000dda808c1f9bd09ab2974813f5bdc953682b7
MD5 b0645a9e04b021bea9c2a736c3987762
SHA1 25f729228646c0b4d5ca74f8fca9bf774d31835a
SHA512 be2a02b736c229ecda349b0be0e10dffa363c218527c421ffe1a89b5387699e1dd9e35df11a1af1cf66b0de744222811e0ee3f5cd12633f5bb7d775856b951e4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 c171a5b55cb3437f5538bc1c0cca47cd459f1c2af1d4c680d3aae3c1c28dc777
MD5 14ddea76a043bf8784933a4fdde15406
SHA1 1c482c776d2ef4af76ede10bd1e27b8519822925
SHA512 c50ae3bee3e541e7c26beb5e10839b2cfc8449579dc435be3c5daa51d6d57d8d75e456bbc2674c8717c1867cdeaaa7abe1b657d265d208d58f39cc54814607c8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 bced929b0c181616265eb08f6abbac42e51a657005f5e482784237eb06de6834
MD5 ba7d865c448aa4650ff8681d0e36ab0a
SHA1 4bbd9261a4183d5fcc1c62d6e02a994fe1b1e82a
SHA512 decc5103a142639aee9d0f7992811f32bb015828636fbffb6e66cbf25c4ba04526c4641205add8fc5b32ce1a4cec53f7fae48fbbf73d222d037b059d46f5e9fd
SSDEEP 48:ovHtYzXvJ8vJzqovJK9XvJOivJpvJYOXvJQvHtY1ogvJzXvJDSvY:sHtYzJYJ+sJK1JtJFJY4JUHtY1oEJzJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 bbb334515d8973f82e8f54cb13e6426c076aca967fb56c56cd9feb1be1adfe82
MD5 c0d094a4ccf555e4bc73b77d5573e036
SHA1 e7bde4584b7985ac9eb759ab94b9cb0ba5b4018b
SHA512 b43fd66dad40b707058886c40cab4f5a7840ac8ee74c9d61c2464459572c7ce2b7d6fc2148761f75ee56fbc96eacab2f87865bad5b6ca5f8ee998f747a87f2a6
SSDEEP 6:KmwlXUWQ9FZdKEAlOERX4PBX4ogLugMBX4suuK+/r8vlxoxTPVOw2:KNlk/zdKBRmBEyPbP/r8vf2TPVOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/consnews.matt960.can/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 18af0e87a1f1a56b017aa644b31a4d081d79c5420f6c75f1a713e6546c71ae39
MD5 05a830c6d65c22f1496cac1fb206b71d
SHA1 f32a21c799b27a2465a5b65292d593a4125c3f69
SHA512 7d27a378fcec3a216bf54fafe111cb0b1f609ed3d90316fb41d51d1b0c772adac4e528be3a084a5edaf49c5a377494c2d334f222d0bfdebc7290c64ebae7c851
SSDEEP 96:1kZ6+hdjnHtDRMpf8UzS5+TD8q0ExPjdad:2VdjnHt9Mpf8UzS5+TD8q0E5i
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAtN.json

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json
Size 11.1MB
SHA256 57b7c8e0879f6b3cd3bb169533f8069072322b178dd2efb8cedf5d77761e32e0
MD5 b2dd75b19e82fd1b6f8c1bbd80b00d43
SHA1 fbcc0c095a6951f1c268c3534e80182275cf56dd
SHA512 078089605d533d1d8dddae498383e79eb37275bb034666cfc5d2b2df13883f9fa417374f1461d091fe0d5d37d09a5d18a2f9c42228e72b68ac8dff01de380395
SSDEEP 98304:jIroDpilznK62kXbMg5jw0uyrLrWYOx3mwpN:ErVw0jvrKxVpN
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes2.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes2.dex
Size 354KB
SHA256 d69d7a5de42fd2219b81e57d5f4cd328e54f9efb9c98dc7977ecca30fea50abd
MD5 81f38c51436583b57b99da62a839ad7f
SHA1 3719a8aa29af2656ffb554863f3f4ff36039acce
SHA512 6d673091df3b7d2538fbe1da035847c88cdfd85eaf4243fd00917ed7335ebced008a24a9bf3c0ba2b71543998e23ea550dd9846d8ed78996d1c9420374630669
SSDEEP 6144:8sfp8AjF1t66i/eu4kElNZ/Lpa9T6Jm59nQ3mWDVc/ZfXlP761li8Jv5+:xGeNdt5PE
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes3.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes3.dex
Size 254KB
SHA256 c23054ed69284e961a6d6af8cf762cead12f720031fa527c6f28fe3168c01f81
MD5 e43a2e60e043ee737a1705cf8c36278a
SHA1 66a82c6d614798c5dde92788e974239765d9c366
SHA512 103d93ef3273f08cc8b94ea05fb79af5cf2ec51d6201722f44c2b3285f3f29dda1b251e818e65148f13833b627604f4f55a8a1ec1528da70ddf0a204893f0d76
SSDEEP 3072:pNXQcbmFAVTd3AUVd1LCwdKsDh9GJhmVo2nZ4BCVcDAcWYz+ijhIvTgYWq1GvETA:pNXQcbmFAHxLHd+mV7LckcPaijMTA1
MD5 SHA1 SHA512 SSDEEP

Download

MAtN.json!classes4.dex

Path /data/user/0/consnews.matt960.can/app_erase/MAtN.json!classes4.dex
Size 1.9MB
SHA256 217bb9f5b5728b6373d10962cffa93c3b263049601ce4bfdc30f1b89c0e69c53
MD5 32579b28ea9ce1c5fa1f35bd4f9818bd
SHA1 8a262963232c8e2e43d755281f46ad7565e62a9f
SHA512 dfb21bbe5a06aa760e412d05e9a91dc14b44928b8f88e6e01f96bfbd3d9a6637c33e8cf5d02dddb038cbd8dba5dd0cc382debb31c66f8f7d6ce3f176b2a6873e
SSDEEP 24576:xfGUb+VwKV63d0EgawFAue4FJc19ZK7ALt3l/zO:xfGl63d07nc19ZKKtV/zO
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/consnews.matt960.can/cache/logs/log.txt
Size 153B
SHA256 ac1b390145e8fe9bec54f26a86e5fcc7211a1ea7b90e385978afaa22495c0e8f
MD5 66579e205fef41a2dd77714320a0b685
SHA1 e8289dbf3f60a6f8d6181182fa907989ef429885
SHA512 e085d439b6895e4306b863359ad6e0cc006889f70c7d95552d458a746c3163731fae21a0ea0bdc6f53ebaa6e467817604005fdfdd11876818d3b654fd48d8fc7
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads