trickmo | ba25744487f1f3b4b5a63aa93a0a38eefe6d502baf3f7eeeac53efe906006b1a

Resubmissions

21/10/2024, 05:53

241021-glkzgstdnm10

07/07/2024, 09:16

240707-k8rbkaycjq1

Analysis

max time kernel
270s
max time network
299s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
21/10/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.4MB
Sample241021-glkzgstdnm
SHA256 32e39963f71cdb20c59382aefb19b2cfa3fb2527f15e12dedf587a8329e30f95
MD5 eb579cf5e93b79e6ec1d46c86daa8fbc
SHA1 ea8ba740e4f96999657772c58b86a8be06feb943
SHA512 425670d791e2e386fe2866dfd3998a588aaa5316c9becd8aee3d079111de8bf1046df08fbe4b36f5e05c32d20700bcf92b8be3c5bf35b697946d357155b734cf
SSDEEP 196608:kX4aEgiFw63MW4JumTG+3m02ugrZLUh0Qsqi:kXFEgiFwEMvGZAp0z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://gofirst.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json	4347	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes2.dex	4347	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes3.dex	4347	mendie.mold390.sfor
/data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes4.dex	4347	mendie.mold390.sfor

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mendie.mold390.sfor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mendie.mold390.sfor

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	mendie.mold390.sfor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mendie.mold390.sfor

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	mendie.mold390.sfor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mendie.mold390.sfor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mendie.mold390.sfor

mendie.mold390.sfor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4347

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

xkDUOf.json

Path /data/data/mendie.mold390.sfor/app_much/xkDUOf.json
Size 5.1MB
SHA256 1756337fb01c2e805a8c6f27de12f48eaca0eabbb11885314125d44adf745365
MD5 6b5e41436b4a6335fe61ff65b33a6b4c
SHA1 a8d6b3d424f9b811e8d7001c449e4ef312b4ca26
SHA512 8efd0fdb01be3d73644e95e44fec897f4450913cca8ce6de829a82825089fdef5a6a0b35b6262575f489e634b1db896cfc25823fbc465fb189b482d2b1f15c89
SSDEEP 98304:OyCMGZU4ntlcCGyMJxkjZST8GYyGcGvoc2+0uWZS6nXO6Ge0zhMI/JjihyhT8:eWKPcCCJU01GiJ+AS6OzTlihyu
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkDUOf.json

Path /data/data/mendie.mold390.sfor/app_much/xkDUOf.json
Size 5.1MB
SHA256 534bf5f167c00da92b246d7a4448a6a561fbfd7139d06d0951368727159a13ce
MD5 739a06ac778b235036743cf0e5a74bea
SHA1 ef29d6997078f8bbf193d51e2784a977fa844129
SHA512 7796ad4faab127a7bcf1c57c406f85db8275cd535214a27dc2cdad252c664140ecda73646ba7bc0a4f87ef51f569c0de728bcef5bc8443f4248cd4cc50439df7
SSDEEP 98304:Em9I4zy/vbrqv+bVm4BjKydL3Npq+ytvJNi+liIdhfVwzUMZpwHxxo3rY7sBFFf7:/BG/vbru+skjKOxUvJw+lRrfqAUWHxxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/mendie.mold390.sfor/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/mendie.mold390.sfor/databases/a
Size 20KB
SHA256 5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923
MD5 91af32c14839a2828ca58297e0861362
SHA1 bd758cc0bb47b570da2061d4633aa998a87ed971
SHA512 9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7
SSDEEP 6:l9bNFlq4yl18y4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLm8yNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 512B
SHA256 81129c3d48ec6b908bbb53f1ccca9e13c0c006e5905e6116032aca3196b3e888
MD5 baedf92120b53a65068494c8734bb88a
SHA1 daa0c35756f73957c03e0b439ef909713abcc202
SHA512 0d7bfdc8b5da94714ad0cf27be1917b635a129ffdf5f1b0db493aca9bd9ee1b8392397102744d1ae71bdab916fa09c8c044caa026d8d8cacc6aa574780bc7b86
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 8KB
SHA256 6463243e8fa62e9f047fa59fc8fc339d420a09d4ae7ef3f9943b54ac957ecdd1
MD5 340c5f7625c8d2abc8b4a4b070fe2c32
SHA1 9c31565b856a28dcee2f350c4a7c43816441b50f
SHA512 896574450d3e30210cba2ee63e6d2c15f424f7d0c8acf899d38a754a203f98331bb12d5dedad14b39798aa228f4e191ff2662b07d0d669e09168c864cf633d8e
SSDEEP 6:7+/l9Eeon1M6g9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKU:7+tFf6qLiuWd7RmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mendie.mold390.sfor/databases/a-journal
Size 8KB
SHA256 6ceee4b84ea76f479dccba27894984b71a2393247461157f612f0fcb1476c3de
MD5 829bc4e43024df998828665d87a09fb1
SHA1 19bda4fd40a4ad9c5f5788aaa74c729e34b74605
SHA512 dbe06cf9c9939b4c9e6cd75e2f96e82283e754d50522c7fe241c86711f75d64746bca0b2e523f04193c3eef441669b9937af4c004f60a87d1e2cbb3dc6864b51
SSDEEP 6:7+/l9LfHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKk//Q:7+tpXqLJdKBRmBEyPb7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

mendie.mold390.sfor

Path /data/data/mendie.mold390.sfor/files/mendie.mold390.sfor
Size 256B
SHA256 344f6756783305695497d56aab95e82680447f123560049e68e5d66ab0526e18
MD5 44d12d84cf94b5b11892e37cb1852242
SHA1 357c4d124bf692970e438c389a1c368d94493a47
SHA512 9c2f3106d5ec7fce5b6815c250a7cbafb03efcfe1b2b99188869f643a8555e6809d536ac166795567ab94adb3185fbf77daabad1ed9d0fa22253cc923d764832
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 949c6a1587cf331aa810642b638deeb68ae23f5f810949bf70746282ef299402
MD5 939c87a6171af69d21e373f37ab06f18
SHA1 c742e1f249d816c24e57c7c3fda353f1c11a0c75
SHA512 5bf8882758e3701a70bae307d97e0061f17e2e6d7b3642f61bff9069f0a1a054577763c6e8ac9e75a831219047bc1c2505015951c54280b899b48248bbd17ed8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 eb2c800e365690a1b31484239d871535dda5a293e401f45c00e8f0b839bd8cec
MD5 db8fac3e5e74038a5ebbb948b7fabefa
SHA1 35a2edb65e8da8ce83e684d29344fee125a78c90
SHA512 54365353cfaf08cd16da3db745041d55e8dbe74095d9ccb6855b4bf708d1c92e6da765f6ec12bee272e0e9023df974b53fd3a54df1be3e57343e6ec33adff290
SSDEEP 24:eZbtYfdT9WFDAUX+/HxuK/HCjLtT+J1eKci4TzwPEQbtYJnRgHxu5NKPfg:itYGdQUp+tYTgIp
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 d8b7703da4ddc9de42d8ff75d602919c0d185147bd2b66a3e8e6af0acfc05ac1
MD5 2e320dad6cb5a57a0e2b064dd26a7aee
SHA1 be7167dd31b3f56c4ec6dc31ac9f8634f5bb2542
SHA512 19e9334c8a74f26e261189a4de92601d99f2eda6c51305e374e3d7ec80c376133d3831602629f68002c0b722573d257f4844b19465941b875e2a2315afec933b
SSDEEP 6:KCbX8U0bdKg9FZdKEAlOERX4PBX4ogLugMBX4suuK+/4bx2KgRhDqiOw2:KCbsXbUqzdKBRmBEyPbP/4bx2hHvOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mendie.mold390.sfor/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 e417540351d3280fea4ae492570c523c733a38873f90829dcb65a17bcc8deecd
MD5 f32ee1737f383faa8a1da7929e6785c0
SHA1 a4d53dcda3ba4e72a233c7847cecec3496ae86ee
SHA512 e8522aacd46825d460c71d12bc838ee5890e3ecce3d3051790f9026bbf238d0891cf1f870f6c634871f0112aedd2e42adbc1cd4357be666868832850e199f0f2
SSDEEP 96:skZ6+hdjnHtDRMpf8UzS5+TD8q0ExPjzPTgzld:/VdjnHt9Mpf8UzS5+TD8q0E5Or
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkDUOf.json

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json
Size 11.1MB
SHA256 57b7c8e0879f6b3cd3bb169533f8069072322b178dd2efb8cedf5d77761e32e0
MD5 b2dd75b19e82fd1b6f8c1bbd80b00d43
SHA1 fbcc0c095a6951f1c268c3534e80182275cf56dd
SHA512 078089605d533d1d8dddae498383e79eb37275bb034666cfc5d2b2df13883f9fa417374f1461d091fe0d5d37d09a5d18a2f9c42228e72b68ac8dff01de380395
SSDEEP 98304:jIroDpilznK62kXbMg5jw0uyrLrWYOx3mwpN:ErVw0jvrKxVpN
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes2.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes2.dex
Size 354KB
SHA256 90f37024e4462da754ff577727188f9a816b275e9bd0b2c93ac0fee8aaf34e13
MD5 f4426e15d81ce090a167867de97088c8
SHA1 eec3bb62f61f4725d8e6e5bfa5fcc9e2837971ed
SHA512 086ad06f27a956b4fc1bd8a1cb35c334b7131974f27f92491cebf188be94b091a304d9aceb93e02bf20e25f0682302bbc8ee06892f13d339c4f8b2a898a0f44c
SSDEEP 6144:rgfFQh8AjF1t66iPeu0kwqIAP+puma9T6Jm59nw3mWDVc/ZfXlP76dli840idoG:SPe5XzT5e0ieG
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes3.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes3.dex
Size 254KB
SHA256 014a1b9af5a1514d88c444a00cdc3a910c5f4d4c55e2307186fe7bb908d268be
MD5 3f8ab68fa2bfe879073f7d34e2fa9fba
SHA1 4779c13b65844b93d69823e2f4ec24d8f7222ce4
SHA512 7d12e8997d6b32511964520414a0d5d33b92e6a2d1284af61d80b9c3c0a6f5d2325a3354b2d8c7bc86dc612750da35bb4f5da1fc73c518d68aa824064294027a
SSDEEP 3072:INJM0MLfdoBNRfpUkmUVd07G6SEsDh4+hm+qcwQJtShP5tJ/Az9hZgJ8JRTCaLDp:IN6N0VS7zSpm+LfShHZFYoJVi
MD5 SHA1 SHA512 SSDEEP

Download

xkDUOf.json!classes4.dex

Path /data/user/0/mendie.mold390.sfor/app_much/xkDUOf.json!classes4.dex
Size 1.9MB
SHA256 217bb9f5b5728b6373d10962cffa93c3b263049601ce4bfdc30f1b89c0e69c53
MD5 32579b28ea9ce1c5fa1f35bd4f9818bd
SHA1 8a262963232c8e2e43d755281f46ad7565e62a9f
SHA512 dfb21bbe5a06aa760e412d05e9a91dc14b44928b8f88e6e01f96bfbd3d9a6637c33e8cf5d02dddb038cbd8dba5dd0cc382debb31c66f8f7d6ce3f176b2a6873e
SSDEEP 24576:xfGUb+VwKV63d0EgawFAue4FJc19ZK7ALt3l/zO:xfGl63d07nc19ZKKtV/zO
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/mendie.mold390.sfor/cache/logs/log.txt
Size 153B
SHA256 3fba3df994d56994673ac3648ada7c2557ebf735a594af9ba49d2541c97570c4
MD5 66b37a7803df20b909b23b0fb95a47d6
SHA1 2603022f7f2c95692bf1eeabc4b541ca6aafdf8f
SHA512 09a15e9c7e781479481523aa693f21c7e0cf8f686632c9247cfb93c83c41dd308c68f1e16e404cfac9b96b645b8ea90f84e16fe510f4ba8eb50d4233411701a5
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads