trickmo | 20c21a0bf466412118a8b79e890e2ce5dd068a9a2d354f43f6b4b7c94ee16509

Analysis

max time kernel
107s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
21/10/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.6MB
Sample241021-grflystfjm
SHA256 8e8470ed0fd881e9c7ad3db2bcb9515a9dc8fbbcf9fdf38169330514524059ef
MD5 ca99cd533c8f93ab900b9eaa2368b6b0
SHA1 e9dfe27df482d853a8072bacb734bccd05227d35
SHA512 f1f495744e9cac629412e7e9eb0828f6d1197a84bfa2692a5bf34022f3a754d4a78907fba0ec8cb5b2eda6d03ff17b59ae7d7f93fb6cceed2be87e909885ab4d
SSDEEP 196608:X1H7QE5m9OHWTpCiAIR4dpMy3Vhx+KOs4G:X1H7Qgm9dMICFf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://starnow.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json	4314	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/pekers.car413.qui/app_rude/ZMnj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/pekers.car413.qui/app_rude/oat/x86/ZMnj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes2.dex	4314	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/pekers.car413.qui/app_rude/ZMnj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/pekers.car413.qui/app_rude/oat/x86/ZMnj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes3.dex	4314	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/pekers.car413.qui/app_rude/ZMnj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/pekers.car413.qui/app_rude/oat/x86/ZMnj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes4.dex	4314	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/pekers.car413.qui/app_rude/ZMnj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/pekers.car413.qui/app_rude/oat/x86/ZMnj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json	4257	pekers.car413.qui
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes2.dex	4257	pekers.car413.qui
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes3.dex	4257	pekers.car413.qui
/data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes4.dex	4257	pekers.car413.qui

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	pekers.car413.qui

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	pekers.car413.qui

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	pekers.car413.qui

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	pekers.car413.qui

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	pekers.car413.qui

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	pekers.car413.qui

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	pekers.car413.qui

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	pekers.car413.qui

pekers.car413.qui
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4257
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/pekers.car413.qui/app_rude/ZMnj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/pekers.car413.qui/app_rude/oat/x86/ZMnj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

ZMnj.json

Path /data/data/pekers.car413.qui/app_rude/ZMnj.json
Size 5.1MB
SHA256 516c9d7ac13f1c36aa6daa4831b468300e38d770fe406a986b29a7eb0d93d400
MD5 055e11f346de40ad4a6abad3546ea225
SHA1 8c9cf7cb825b2411146a3b4e2aad27f9229e3fa9
SHA512 2b1b011be419297887194fd269879138db8d9be461aa93f5443e9b6aecdc4048b99611343cb69357c78dfea5f6eba3d06fdf3e528c54e8c2563b74ea07e4537b
SSDEEP 98304:LH1u70djODIv1jPGaMAQIzP2dB98qygcAHVzuA34XgCKrPxDTwydA:Zu70VODIvBGayID2djmABBtxAOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZMnj.json

Path /data/data/pekers.car413.qui/app_rude/ZMnj.json
Size 5.1MB
SHA256 d1596837b8e5bc67ca3a3206f065a4bd7e8ed8d4c062daf348f138647cee8b2b
MD5 7dd2673821338d19e639cb56a823ed65
SHA1 d0aa9e03240bc7d8985603005e69044b7de7c724
SHA512 d5bdfc9702f43d6452584c4b137581688d6586345cffcdf169abe7acb26a58cb226504e84f1cc5320474019bfb3cce8c03c41e73beea359f9de4fdcfa0a39798
SSDEEP 98304:1mfey/v2rqv+bVm4BjKydL3Npq+ytvJNi+liIdhfVwzUMZpwHxxo3rY7sBFFftH7:sN/v2ru+skjKOxUvJw+lRrfqAUWHxxon
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/pekers.car413.qui/cache/clicker.json
Size 17KB
SHA256 c890742667132d62ea76f4f9ccb64a67e06ee6f4dddd39da458fcf46fd567b5c
MD5 636e55d791176f11d06b28d2e3bef86d
SHA1 685a82b348877c97f50def61ac0bedc02035255b
SHA512 4d656078ae7ca93daa3267cd08af620a7ca375a51ee07f998c1a33607665fcfa6a786f80bc2ca022b7629de3b095d7c29cacdbd9581a58cf1f101df3de5924d2
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5webgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5we0fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/pekers.car413.qui/databases/a-journal
Size 512B
SHA256 a21be26007bff6244284685eb9218f3f8bf73509cd7724236f3de17cf08b58f6
MD5 b5b2f175fc3bb562b23e7430fa1a2986
SHA1 0bcd2eabf6ad25878dab22d0060eccb81f811708
SHA512 9dd540b914e21b1ba9487f525635d62415d6019423446d4fe145b52ce13c462fb93679e9dd47f3abc5b3cde10ad1e9ec476a0a887517c0b01e9e5ee47db1e3ed
MD5 SHA1 SHA512

Submit Download

a-wal

Path /data/data/pekers.car413.qui/databases/a-wal
Size 32KB
SHA256 eacc2bf89d3e5006a92321726107dc1d9972ae8fa5a3f8c5f0d996d9cb40a7d8
MD5 fbb9bf311b29ae25d5e9b2a441e3ff6e
SHA1 45344f93c388d34ab25100038acbd030607c7b8c
SHA512 b30ba06b9305de11df20f02abddd7cb08165f3cb3965cfbf1c29996b37d052694afbb93a93b6d66790d44adedcce4092e9bfbc42d0e0ac7b3730f30a83736816
SSDEEP 24:KiQ+RQ+3lzyGSP/UQ+K3tkQ+oTEPjGSP/UQ+TQ+9KHR9:n3RlzNSP/UT+T/SP/UVIR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pekers.car413.qui

Path /data/data/pekers.car413.qui/files/pekers.car413.qui
Size 256B
SHA256 e0c143b6524bf0698c150c978da3995b5d58fedc4033f2f66a49ada772d5fa40
MD5 8d9efd82eed9928422d924b7028c84c6
SHA1 aadfdffdac480f5f1cf7fe62b5f0dcac3f6ce27e
SHA512 665f650cb89712bff6efaccc462e6d018d803d83339b934b82c08bedf95189f28a9f6b23f8d73cbdf5affac119dfe4d1b20e05ab0a8aa601c58e0675fc1e69f3
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 34ff2340e573c1edea04f494cba86e037f29994c0e09997829f24db5ff71c5a2
MD5 133adcf6d8866b76e8283273ba559d85
SHA1 9b55b1c4a027a228722d45c29a6e4c802ddf414b
SHA512 48ec77ff0ab8f50afbfaea0d1775c10ab7beb1b7acb76d59955e63b2ce8f65701beca562efebd4c3cd470c67ab5bf7fe03ce5b8018f576521436adc5c64da6d7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 83a1fbfbe2f993d86c67ac5ea47639b15cef6fb2851fb24ca26cb2f4ae3689bf
MD5 ec54e8f95216864a2fa48286a03818d1
SHA1 443d21841a57b8b6ac4bfb1467043e45ec407742
SHA512 2eba3a778400a5a002f525240e1ab7c5e2ff7d3cd776426f9d6357c868aa8fe76b6428aa34df50718d66da080dbfe723243e2f6eb5f91d373758f217071a657e
SSDEEP 96:gkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPa8WoheQPUHhd:DVdjnHt9Mpf8UzS5+TD8q0E5DRh9uH
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 c123ce5dd4e4cf422139bcd08012e2a3d762582aae2c9eec613aa0f7de41b465
MD5 0528f016e2f736d579e4b36f0d524b51
SHA1 4577766fd783fef4a40c1001e18182df35ad9374
SHA512 68eca2f93fe8fa664f922c196747e6cef1a8996a800a4f26068016f6acd29b8c15e95f030d708389c8e5bdbc361c7edcfab2ddcf9c917875ec0572141d82f2ea
SSDEEP 12:TDtK8fMLgbhtMXrXD+Sna1E00L10cVfMLgoau1fMLgoa0SnazjOm2va19hva8cH4:TGsFtYcjZsYasKJ2mlL6asFtYnnUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/pekers.car413.qui/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 46f927dc9d689ac3d0ef5bce6bb6cf4ef599d38507940bc89b540cdda28f6f06
MD5 6c07464709e21569b90d99028f07839e
SHA1 a5b9c417945a74e2225c78151b862abc9c3512d1
SHA512 60d0c11480db62277692b7e13c29bdb8f4187d30b3c23a8bb3549188f57fa1139d67fc78a76d9d09da9edd161b8426230e133ca6288fcdcfee2aad39bc28f071
SSDEEP 6:KJOO8xOP9FZdrlOERX4PBX4ogLugMBX4suuK+/DO3H04/lgfqiOw2:KokzdTRmBEyPbP/J4/lmTOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZMnj.json

Path /data/user/0/pekers.car413.qui/app_rude/ZMnj.json
Size 11.1MB
SHA256 57b7c8e0879f6b3cd3bb169533f8069072322b178dd2efb8cedf5d77761e32e0
MD5 b2dd75b19e82fd1b6f8c1bbd80b00d43
SHA1 fbcc0c095a6951f1c268c3534e80182275cf56dd
SHA512 078089605d533d1d8dddae498383e79eb37275bb034666cfc5d2b2df13883f9fa417374f1461d091fe0d5d37d09a5d18a2f9c42228e72b68ac8dff01de380395
SSDEEP 98304:jIroDpilznK62kXbMg5jw0uyrLrWYOx3mwpN:ErVw0jvrKxVpN
MD5 SHA1 SHA512 SSDEEP

Download

ZMnj.json!classes2.dex

Path /data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes2.dex
Size 354KB
SHA256 c6114bf54ee58e37657467acfdf8e5d147b778a1e718e085e1f0a6a14e0a480c
MD5 e111d110016c06792f99189957bf5768
SHA1 ba1b4f6e7c7170239e9c001779ef9ff2995ef5fd
SHA512 c98bc318f555b059ee1c5b0ef9bef2076b1bd265ada3d303a05e2fe481e2dcb40fb041e1e136d7a1ec0094e08020b0064bbddcc5efc5c32caa71ab42bb27a215
SSDEEP 6144:8Cmh8AjF1t66iPeu0kwqIAP+peea9T6Jm59nA3mWDVc/ZfXlP76dlk8AtwB:BeJnzz5UtY
MD5 SHA1 SHA512 SSDEEP

Download

ZMnj.json!classes3.dex

Path /data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes3.dex
Size 253KB
SHA256 5e60365bd94ccf2533cc24ffeb4b69ee1b66283e4472e92ee8741b821f26c72b
MD5 6a828a2f97a63e9bfb7a8479ab4c6832
SHA1 6bc2017f672b3c68b6a19d2226f46f5519d168bc
SHA512 b58c4f1caf85196de0572544e00a51d62e11b2c59fb60b7f66ed5ec77b4b587f02aeacae1602a7c68532be8990ef84e6c3887bb35f66b2725c2b651ad7193937
SSDEEP 6144:DN6EMwjt5pkidxvHduCgzunlIP+d6RjRpii3Z9pm:D46JHNYii3ZHm
MD5 SHA1 SHA512 SSDEEP

Download

ZMnj.json!classes4.dex

Path /data/user/0/pekers.car413.qui/app_rude/ZMnj.json!classes4.dex
Size 1.9MB
SHA256 217bb9f5b5728b6373d10962cffa93c3b263049601ce4bfdc30f1b89c0e69c53
MD5 32579b28ea9ce1c5fa1f35bd4f9818bd
SHA1 8a262963232c8e2e43d755281f46ad7565e62a9f
SHA512 dfb21bbe5a06aa760e412d05e9a91dc14b44928b8f88e6e01f96bfbd3d9a6637c33e8cf5d02dddb038cbd8dba5dd0cc382debb31c66f8f7d6ce3f176b2a6873e
SSDEEP 24576:xfGUb+VwKV63d0EgawFAue4FJc19ZK7ALt3l/zO:xfGl63d07nc19ZKKtV/zO
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/pekers.car413.qui/cache/logs/log.txt
Size 153B
SHA256 c7293d30c0c21ff319a02e1f6b83337f36d89ed91d77e2f424671b54e0e7252f
MD5 59dd21578d462afc5518441cb01c8eef
SHA1 6219dd23581f3e9cf4d73f97be6f97368e3214ab
SHA512 d5b2dd73743e11f42dab4f404e398e5729378051016ab9817bfb6b74a36c1c3579204427068c056305fc56104eeb2e8b92ebae4e907cd8afbd07a541c4c37ce8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads