Extracted

• • Target
    trickmo.apk
  • Size 11.0MB
  • SHA256 a755cbfc1a25a54bc3d1d12d8a1d82f28b910b9cf870716529f32d5d02bc4c65
  • MD5 c9e87f75a394e2c5e11288d2d611a931
  • SHA1 2cd928ccfe3b8f72958b6068e81cebff01414370
  • SHA512 88b29ec7cceba2deaf67e40510b6a999fb8ceebf9ef18ee65a3a6d9b06d7741417618a77cdaba6ea554b20a91f65e3751421c506ae2cfa8d3534ca99428d9ba0
  • SSDEEP 196608:C3ljOQWaNYw1kBnsI0galDL25GzhSD9MbBHEbiq2CFMg9qAh:C1jOoY4kx0DL25GzCSBHEbirg99h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tanglebotevasioninfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1behavioral2behavioral3
• • Target
    base.apk
  • Size 7.2MB
  • SHA256 f1401e63b56fc8f013b5222139f8e2d663dfc03475d6f9cb5dd1c0a65466e598
  • MD5 a8eacae2142d9ad431cc07a2eb41d618
  • SHA1 e6dd5713bff00d0ceb4639f0a847044bd144f682
  • SHA512 1c8b7a4aba40306b39e75a0bdf99eddf59ee9a42fd596bdecf7ac0ab70d5fc2ad130a1cc9dc234154eadbd51667b4947f83d7d15c7543d089f67427d8df17b0d
  • SSDEEP 98304:bpo0fn7U0Jnem4AqI5zJG9fBZ2ZHKC1AMilltEXXZ6vrj7lTmpJ3xxtAlL2AMCHF:tfveCZiXaXpijlkJBxcBYGcKlyWTKU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  trickmobankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan

  • TrickMo

    TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.

    trojaninfostealerbankertrickmo

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral4behavioral5