trickmo | ba25744487f1f3b4b5a63aa93a0a38eefe6d502baf3f7eeeac53efe906006b1a

Resubmissions

21/10/2024, 05:53

241021-glkzgstdnm10

07/07/2024, 09:16

240707-k8rbkaycjq1

Analysis

max time kernel
252s
max time network
298s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
21/10/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.4MB
Sample241021-glkzgstdnm
SHA256 32e39963f71cdb20c59382aefb19b2cfa3fb2527f15e12dedf587a8329e30f95
MD5 eb579cf5e93b79e6ec1d46c86daa8fbc
SHA1 ea8ba740e4f96999657772c58b86a8be06feb943
SHA512 425670d791e2e386fe2866dfd3998a588aaa5316c9becd8aee3d079111de8bf1046df08fbe4b36f5e05c32d20700bcf92b8be3c5bf35b697946d357155b734cf
SSDEEP 196608:kX4aEgiFw63MW4JumTG+3m02ugrZLUh0Qsqi:kXFEgiFwEMvGZAp0z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://gofirst.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json	4651	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes2.dex	4651	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes3.dex	4651	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes4.dex	4651	mendie.mold390.sfor

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mendie.mold390.sfor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mendie.mold390.sfor

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	mendie.mold390.sfor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mendie.mold390.sfor

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	mendie.mold390.sfor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mendie.mold390.sfor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mendie.mold390.sfor

mendie.mold390.sfor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4651

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

xkDUOf.json

Path /data/data/mendie.mold390.sfor/app_much/xkDUOf.json
Size 5.1MB
SHA256 1756337fb01c2e805a8c6f27de12f48eaca0eabbb11885314125d44adf745365
MD5 6b5e41436b4a6335fe61ff65b33a6b4c
SHA1 a8d6b3d424f9b811e8d7001c449e4ef312b4ca26
SHA512 8efd0fdb01be3d73644e95e44fec897f4450913cca8ce6de829a82825089fdef5a6a0b35b6262575f489e634b1db896cfc25823fbc465fb189b482d2b1f15c89
SSDEEP 98304:OyCMGZU4ntlcCGyMJxkjZST8GYyGcGvoc2+0uWZS6nXO6Ge0zhMI/JjihyhT8:eWKPcCCJU01GiJ+AS6OzTlihyu
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkDUOf.json

Path /data/data/mendie.mold390.sfor/app_much/xkDUOf.json
Size 5.1MB
SHA256 534bf5f167c00da92b246d7a4448a6a561fbfd7139d06d0951368727159a13ce
MD5 739a06ac778b235036743cf0e5a74bea
SHA1 ef29d6997078f8bbf193d51e2784a977fa844129
SHA512 7796ad4faab127a7bcf1c57c406f85db8275cd535214a27dc2cdad252c664140ecda73646ba7bc0a4f87ef51f569c0de728bcef5bc8443f4248cd4cc50439df7
SSDEEP 98304:Em9I4zy/vbrqv+bVm4BjKydL3Npq+ytvJNi+liIdhfVwzUMZpwHxxo3rY7sBFFf7:/BG/vbru+skjKOxUvJw+lRrfqAUWHxxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/mendie.mold390.sfor/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/mendie.mold390.sfor/databases/a
Size 20KB
SHA256 49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
MD5 57baf3e42a94e8dd82e267b2f0619330
SHA1 76512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA512 227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
SSDEEP 12:TLmaEyNTSFbyiyuE9dMARmBEyPbAVOwG:TLXREPjGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 512B
SHA256 19de08592238d85bdc579704a8c3bc244477d4c76ed3be4d470c3ae078796303
MD5 3b137bf5e9aab92c1b59b075de2ac197
SHA1 80ba7af3d4235be24a50f31a82de26cfcf0aa89c
SHA512 5873934bbc89eab0297281ebd0722762aae26b9a8a9d9707e1bd7696f5a8a9a02b02cebfe614af79e7c094477b29b299b09de1505d31898d7af519ba20ea46ef
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 8KB
SHA256 176c8188e61835175e7f9d1de914b22238fc33ca7e85c6f75ce7d3b401a8cd65
MD5 c98be8d80bd664166d9804fdb37e21ed
SHA1 42c3cea119c7dad27dd818dafc644dffbd4e4b30
SHA512 1df3cfea0e5562d51ef9e7b971ec509dd1ca52654cbc0bf5c7c619e378c24761fecca74e2fc55b0daee6c6e23fae8eb4d63cb77b227483d51d1cca95bb6a3fac
SSDEEP 6:7+/l9Gg8Fn19Rg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKUN:7+tMZrqLiuWdYRmBEyPbBN
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 8KB
SHA256 1ff6a01067b0f876f85ca462e253ae194b478e60032eb203e4db8316ac6338f4
MD5 aa2c1cb4662d2fb06042d9fa48a4f95e
SHA1 4ffc622d39c791180fe99e7103510a4dad0f62a9
SHA512 a11c243705a9b8017b662e61c27cfe69fbf613339e9a29d1b12b20b9f323afc3c72fdee5f5ca8b91cca7a12f648d35c0e6271c62260eb9335715ea528792d0d1
SSDEEP 6:7+/l9cYGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKp//Ei:7+t2qLJdeWRmBEyPbOXEi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mendie.mold390.sfor

Path /data/data/mendie.mold390.sfor/files/mendie.mold390.sfor
Size 256B
SHA256 c6809df8654976690667c0d7ac78175b6f519cbab5958df44d40348ccbdab058
MD5 7c5c66a7b96f9af095ea4e7e2a4c0fb7
SHA1 c0940f8828a8a60ed5da185be1daaa237262af28
SHA512 e780b643cee6f99902b43b03f55f86ccfaeaadc072240f2117686cab59b684e0191c444e15bfeb1934f33dc17f9874917052bfca11d978c0bc9a67871d0c33bf
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8f8b85ec9f986e36aba49f2b08a40097e3873a94b640b348569b0a8858cff0bd
MD5 7fd39c8e5c0a6082bfd126db29497783
SHA1 0b49de706979ce70a6fc005e2d835f4a4fb8a9fc
SHA512 465272264252001e54efea5609a434220a4713ae1d59233121f02adfe4ec8bcecaddce8311fd7ad9398e88b418100ad8ac882ac0bf71f134df55354311212e3e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 9b00fb0dff5d387d3eaade301c1ecfda493b14dc48f2050405f73455560b2c08
MD5 2b871ef0a6aa3221f630c63f2636e808
SHA1 53b662925d71377e854bc7cb4961a3e39880e169
SHA512 f0adcd5523d4a922f4ffcc2227072fd290bb1b51e7369bf3d4c8037502b3f3b33299f01eb9aad78292b1ff9623888f07ed02ea4950174525f8c4ebc7e905b1e7
SSDEEP 24:K53btYrG5vB0p+p5hKp5A5sfoKJ/5yU5JN5V53btYW0Q5So5T:KNtYrGdPcugoK/8UrNbNtYWV4o5
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 22aa14d22a9aaa2871fb77abd726b9e6bc5cc2e0c5c57eb3316866415de8e98e
MD5 46a57823dab874d14009300fe6e1406c
SHA1 e15c649750f7196676802c77e289b1b8fd4c4a9f
SHA512 b5813597af0a1cc827a8919f3c58932abdac761c9be49896dc30db583ebafc5f20c48268ae5b75c9f9315878b4c1ae1694b28c526709d6ac230c96c310587bd4
SSDEEP 6:KvylkHtQg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/rUsf2asW+TOw2:KRlzdeWRmBEyPbP/gVa9+TOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 920bf349b14891e240a964060104daf9e7dd1b340f6c5c4b4bfae739752271fb
MD5 683c113a3be6ad627ba5ed12a644931f
SHA1 ebe6f601fc0d335ff394300ecbbee2a50ac94955
SHA512 93995c63c5e25b0b3ba6f92a83f669002d1621f0817ad66e559db4a241d53dc0d80279015bfcacb115a32a65b043e9ece51a7abfba3fa3ea8a56bdbd963a6a70
SSDEEP 96:2kZ6+hdjnHtDRMpf8UzS5+TD8q0ExP2rfyd:9VdjnHt9Mpf8UzS5+TD8q0E52o
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkDUOf.json

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json
Size 11.1MB
SHA256 57b7c8e0879f6b3cd3bb169533f8069072322b178dd2efb8cedf5d77761e32e0
MD5 b2dd75b19e82fd1b6f8c1bbd80b00d43
SHA1 fbcc0c095a6951f1c268c3534e80182275cf56dd
SHA512 078089605d533d1d8dddae498383e79eb37275bb034666cfc5d2b2df13883f9fa417374f1461d091fe0d5d37d09a5d18a2f9c42228e72b68ac8dff01de380395
SSDEEP 98304:jIroDpilznK62kXbMg5jw0uyrLrWYOx3mwpN:ErVw0jvrKxVpN
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes2.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes2.dex
Size 354KB
SHA256 90f37024e4462da754ff577727188f9a816b275e9bd0b2c93ac0fee8aaf34e13
MD5 f4426e15d81ce090a167867de97088c8
SHA1 eec3bb62f61f4725d8e6e5bfa5fcc9e2837971ed
SHA512 086ad06f27a956b4fc1bd8a1cb35c334b7131974f27f92491cebf188be94b091a304d9aceb93e02bf20e25f0682302bbc8ee06892f13d339c4f8b2a898a0f44c
SSDEEP 6144:rgfFQh8AjF1t66iPeu0kwqIAP+puma9T6Jm59nw3mWDVc/ZfXlP76dli840idoG:SPe5XzT5e0ieG
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes3.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes3.dex
Size 254KB
SHA256 014a1b9af5a1514d88c444a00cdc3a910c5f4d4c55e2307186fe7bb908d268be
MD5 3f8ab68fa2bfe879073f7d34e2fa9fba
SHA1 4779c13b65844b93d69823e2f4ec24d8f7222ce4
SHA512 7d12e8997d6b32511964520414a0d5d33b92e6a2d1284af61d80b9c3c0a6f5d2325a3354b2d8c7bc86dc612750da35bb4f5da1fc73c518d68aa824064294027a
SSDEEP 3072:INJM0MLfdoBNRfpUkmUVd07G6SEsDh4+hm+qcwQJtShP5tJ/Az9hZgJ8JRTCaLDp:IN6N0VS7zSpm+LfShHZFYoJVi
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes4.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes4.dex
Size 1.9MB
SHA256 217bb9f5b5728b6373d10962cffa93c3b263049601ce4bfdc30f1b89c0e69c53
MD5 32579b28ea9ce1c5fa1f35bd4f9818bd
SHA1 8a262963232c8e2e43d755281f46ad7565e62a9f
SHA512 dfb21bbe5a06aa760e412d05e9a91dc14b44928b8f88e6e01f96bfbd3d9a6637c33e8cf5d02dddb038cbd8dba5dd0cc382debb31c66f8f7d6ce3f176b2a6873e
SSDEEP 24576:xfGUb+VwKV63d0EgawFAue4FJc19ZK7ALt3l/zO:xfGl63d07nc19ZKKtV/zO
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/mendie.mold390.sfor/cache/logs/log.txt
Size 223B
SHA256 47a733f6ee3cd676986611e1c2dcc45c1b8fed0f9a0fc1d80a13847f8eaf15b2
MD5 01912f4295d5576f0e08ef4bfe04836b
SHA1 b360ebbbd3aea17f2f2cf56061aa014517bed52a
SHA512 f329a0170404c79e06748f2ca6e635dfe3a11ea2ef66baccd221715a0f3ea6c2fc04c58890bc650528826de22d60a049725284dc86d5d68b1f1747228731c078
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads