trickmo | 4fcce7c445d89d7de943ec0e0c2fc285d4b25a67950ad7d6bcb50dbcbc4ac29b

Resubmissions

17/01/2025, 08:53

250117-ktnl5azqbl

17/01/2025, 08:53

250117-ktdf6azjet10

17/01/2025, 08:34

250117-kgfqraynfy10

Analysis

max time kernel
43s
max time network
303s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17/01/2025, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deper.apk
Size 6.8MB
Sample250117-ktdf6azjet
SHA256 c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
MD5 2d34dbb4167ebb371e33f3ce700fdbc8
SHA1 4a20849866f90262f9a0b2793f84cc7d5e057656
SHA512 20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
SSDEEP 196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://traktortany.org/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json	4275	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex	4275	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex	4275	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex	4275	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json	4249	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex	4249	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex	4249	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex	4249	lansa.sis722.sers

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lansa.sis722.sers

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	lansa.sis722.sers

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lansa.sis722.sers

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lansa.sis722.sers

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	lansa.sis722.sers

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lansa.sis722.sers

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lansa.sis722.sers

lansa.sis722.sers
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4249
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

dZxFW.json

Path /data/data/lansa.sis722.sers/app_cigar/dZxFW.json
Size 4.9MB
SHA256 c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83
MD5 9f765bbbb28171e35f6f17ee95ebdb90
SHA1 7bfb941907bea2a41e20f38e31c07566d8d3f7ef
SHA512 144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5
SSDEEP 98304:vJwuKnCPw8sRMDegN0LWF/CxwwQba4dEq9FVUFBfZgCgK3wBGhhIM2cD/VMHQLiC:vJwuKC3bkIbnd9slaCgzGIM1/VNWOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dZxFW.json

Path /data/data/lansa.sis722.sers/app_cigar/dZxFW.json
Size 4.9MB
SHA256 6296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408
MD5 cd652200aa24e4da945fcca01cf402ce
SHA1 ec15238d8fa5f5906b1725965bb5eaef3f977172
SHA512 7d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d
SSDEEP 98304:3W4blOhwWXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnd:3W4blI7iFA8p2mopLQBwTMzrbudd
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/lansa.sis722.sers/cache/clicker.json
Size 20KB
SHA256 6e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
MD5 e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1 219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA512 443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
SSDEEP 384:i8RL4Ymd/gXPJDYF/ViD6UZsBGotheg8QGfc7Kmr5jeRHJMECRNZhB:i8RL4YmdIfJDy9k6UZsB3theg8QoWKmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/lansa.sis722.sers/databases/a-journal
Size 512B
SHA256 b1973df3e1710133b9da3ff976d2087605a0097b8c217cfe56b505dc45c8f4ca
MD5 bd8f4faf9a05106424404937d0f8ccb4
SHA1 9bb0d507d6873edf47a72df40773a4cc31aa8619
SHA512 ab6924eecd4b33177d3dab8b31e57e8947c357da9518d2eea2b21c1908dd0b4c1b1e151fd569e39b09bca3c65c2d5da274f547c67791463becc88b1912dda0b4
MD5 SHA1 SHA512

Submit Download

a-wal

Path /data/data/lansa.sis722.sers/databases/a-wal
Size 32KB
SHA256 fe08a2a9c03773a89ca68333d576e5c30773208b3fbde7c580244372fdfb3c1d
MD5 fa36b64ae00f6c421ac95380c6e3817c
SHA1 0ea6c5b4414fc3b0376d2a3ec2a3c026ce7bc614
SHA512 cb950c8132403f15e2f4cc24e8fa712cc4c7dae5a9babdcafab7f5c75c7bce89bf95b8ef53888a66e65d8e591db2d564adf1e3472cbeeb1ca5edf73354637b6f
SSDEEP 12:KW5yzdTRmBEyPbP/oKARntiOwCl5FDqyNTSFbyiyuE9dMARmBEyPbP/7kM:KLzyGSP/uRtwSFTEPjGSP/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lansa.sis722.sers

Path /data/data/lansa.sis722.sers/files/lansa.sis722.sers
Size 256B
SHA256 cbeffe6cc7f23336107f40ee6f56307c4ca4e7f5a195855fbcc077b617104bcf
MD5 d1596d57a326d1de623335e4b64f9f48
SHA1 e939146f702c7f1ba6b325cdf2777935cfe008c0
SHA512 963428f936a93aa65e34f77667fcacad1c4c8e6760e115281ed15f3e824f4cbc1a529264960de2d9996408930ba0e88eb37e3f1576bcab3344ee73f836d45f21
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 34e4324035820eef3ce83b17e16a01b063354a099190b8d6168d0fe64980adc0
MD5 3c95afe8ac30db7e1c67bc97da9ce6b5
SHA1 53d33d2355df98a986ab024c650a28de99018bba
SHA512 3b1c38708bd2dab580046fce11b9a6dcbaa45985d72db360961bd595c285b5c95ce0888608bde05509aa438fb9ebd2830ac2cf2dbce73acfe2cb4c6d28abc743
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 737e49fd3db1de1b53e167dca78e39ef254f02d389e32d275301926b06956fe0
MD5 057bd493a7848a946049b4f0fadb7860
SHA1 a2af6bb52c1e82b15442c9f9d9018e700bd4c01f
SHA512 9c1729ad23c3d9187549fc7101dc936c73fdb7e735e63d3fc27b9b34cc7b860e58056cc369a0d693ed532e0deda84b32a5a9de65069a86b2811544e02d09ce32
SSDEEP 96:v6+hdjnHtDRMpf8UzS6+BD8q0ExPHSHrtm:HdjnHt9Mpf8UzS6+BD8q0E51
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 688eea050d9bb8d4696f5a52b83f9532bf4a25ce4faca81bea79d6fdf0fc36bf
MD5 e107fe1049427278467c3a63bd0d035e
SHA1 b1f714c190c229cdc7b4483b3f61889e9ebefd99
SHA512 f8dbb99c5f464104b3fefc806f780064d564fbc653924a22e2fdb2d55d0fd6b28a0e20eb71b843bc872a66a81b4ed34f00b5617855b8586ab1cf6bbe343bbd0e
SSDEEP 24:6ol/DtYrlLptmkglyvLgl4lhICJalMl6TlG1a8yl/DtY5k2lZglT:vtY74WFICkc0ltY5k24
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 2aaa5b90a13a020560f3d56723f74bb7b1839f3cf7c38dbfb9ad7987dec5a218
MD5 b6ba1edd1df3c4ca3c0180be6bee5f9a
SHA1 6a841495aba410ff29e19107d82f90f76ef0ad44
SHA512 231286ddbd3015fd91d6f689280b6ef454633e0ec5f13f455ac49d0203ebe56cc20cb432423505985fa52f08ec4a2be3da908282052e91c2462c1a0a65ddd85b
SSDEEP 6:KAur4CrWuP9FZdrlOERX4PBX4ogLugMBX4suuK+/nr0ejio8Ow2:KAuEC5zdTRmBEyPbP/ng8io8Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

dZxFW.json

Path /data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

dZxFW.json!classes2.dex

Path /data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex
Size 308KB
SHA256 ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
MD5 5e58845043089ee3b37392fec0f23992
SHA1 5e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA512 84387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
SSDEEP 6144:zAovmwaOQX9MEQJJa9T6Jm59qk3mWzVc/ZfXlPPiaz8VFfOZI:L94JTGZI
MD5 SHA1 SHA512 SSDEEP

Download

dZxFW.json!classes3.dex

Path /data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex
Size 265KB
SHA256 0201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
MD5 cc92d248d0c568e5351842d103bce7a9
SHA1 1d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA512 a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
SSDEEP 6144:me3AcZYjRt7Vjc+xYTF+rH/jDfh5co9bBM74XEgOL:ZgrVlq6HvnrBLEgOL
MD5 SHA1 SHA512 SSDEEP

Download

dZxFW.json!classes4.dex

Path /data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/lansa.sis722.sers/cache/logs/log.txt
Size 83B
SHA256 9d8bb4351cc8f2f6ea05818760d8f817a29a1b4189555f065595977624341dff
MD5 f731bfd55cdbe016b15106302b96a94a
SHA1 2679310d062886180f6822ec337d483687cb2164
SHA512 6309930b0f74b400fe7600f44e60f320f87658051f9d76f07852e878153d4696ae9c9801dc6a82de8dd8e93479f7dc6468a8b977ff3b68c56d9fb8f0d8530b32
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads