trickmo | 4fcce7c445d89d7de943ec0e0c2fc285d4b25a67950ad7d6bcb50dbcbc4ac29b

Resubmissions

18/02/2025, 20:08

250218-ywn8bsxrc1 10

24/01/2025, 04:44

250124-fcwh7azqas 10

24/01/2025, 04:37

250124-e8zp2sznay 10

Analysis

max time kernel
42s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
24/01/2025, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

6.8MB
MD5

2d34dbb4167ebb371e33f3ce700fdbc8
SHA1

4a20849866f90262f9a0b2793f84cc7d5e057656
SHA256

c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
SHA512

20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
SSDEEP

196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://traktortany.org/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json	4277	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex	4277	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex	4277	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex	4277	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json	4250	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex	4250	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex	4250	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex	4250	lansa.sis722.sers

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lansa.sis722.sers

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	lansa.sis722.sers

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lansa.sis722.sers

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lansa.sis722.sers

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	lansa.sis722.sers

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lansa.sis722.sers

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lansa.sis722.sers

lansa.sis722.sers
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4250
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_cigar/oat/x86/dZxFW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4277

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/lansa.sis722.sers/app_cigar/dZxFW.json

Filesize
4.9MB

MD5
9f765bbbb28171e35f6f17ee95ebdb90

SHA1
7bfb941907bea2a41e20f38e31c07566d8d3f7ef

SHA256
c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83

SHA512
144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5

Download Submit
/data/data/lansa.sis722.sers/app_cigar/dZxFW.json

Filesize
4.9MB

MD5
cd652200aa24e4da945fcca01cf402ce

SHA1
ec15238d8fa5f5906b1725965bb5eaef3f977172

SHA256
6296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408

SHA512
7d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d

Download Submit
/data/data/lansa.sis722.sers/cache/clicker.json

Filesize
20KB

MD5
e48ae2e98ea5b39dd12819b5cceb7dc3

SHA1
219af8ebe9bb26b76eaa53356a613e5fbb806dea

SHA256
6e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9

SHA512
443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1

Download Submit
/data/data/lansa.sis722.sers/databases/a-journal

Filesize
512B

MD5
e892cd472a7309bbfbb16be9421a8610

SHA1
b246e7c521b4ef6ce9b519e421d4cdc17bf86d28

SHA256
dff66945895ed5fc3648d4e1a44e2caf120f940f82c4e76b4af01fb9d126cc15

SHA512
cfc20bc7f5855b813e44a1f1e1ff19e71e2ff7ecdcdb546ebfe1e892f79f8936bf8166279458f86e5c4a2d57150bd3947246dc7bbb6d5f179edee55eb4ff3e52

Download Submit
/data/data/lansa.sis722.sers/databases/a-wal

Filesize
32KB

MD5
c3b22e52d5355550b8ae3c936f46f92d

SHA1
46dd789f7167275bf547a92b23d56529469bcf97

SHA256
42c8b0bc749351f1b11ba04f8de46593e774ecae8c5a765832cf27aacadb6d82

SHA512
8e3517db9dab265929b8f3cbb7e119709463e3fa897325fa422aff912d55c3973670117c0cd7ca0097eafc84784c3e848f9418c8501d6d0929caf45eb69d3f35

Download Submit
/data/data/lansa.sis722.sers/files/lansa.sis722.sers

Filesize
256B

MD5
f7f37565431bb8dd6b11d78322d82419

SHA1
e9c48b1c5663f966b94ee429cfc212ffaa9f489d

SHA256
ce99166c6bec4433778b281ff409b73bbf0c58e5c4961625fe98cd6a2eaed3b5

SHA512
77ea0728d0c81fb42d6070d456e2d72ece2063c6bf3915121b9c95cc4bc185f868badc25ac68b50e5686e7ebfeb764d8428268e30502912c8dc7cef5c853d7d5

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5351f1e661b7d4b074f5fa8b0749c2c6

SHA1
41c9c86bc61c06f27252e3b96709c5874b8857cb

SHA256
05877704f10fc977be23955ed36676176b45059e9e0846015e1cda2133596160

SHA512
5d001e3e97ed81ea3ecea62e13965f96eaff6967640ba99e7b9d3fdab560c2f3c8dc7b5cdcbbc75ecaac31845b6566ee22e934dc1fc1b3e3769b4d45bf2c9ef4

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
25f871a5050eea718fab063cc6a94183

SHA1
205cafe0f76eb5b1604189f9b210884b5e489aeb

SHA256
ba4d53ad1de20fc85b095ac2dfeb56e1e7325264b33f7319e369a0f4ae14db48

SHA512
a5df3797c032555cb3fb0aafff33dc9ab3f3a18a8ea69249525cff9fcddf2f6ae242e9118dfd3cbf842a0d1f561d75419cf9cf97c18303bcc3da34dc26be8d3c

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
9c03e75a0fe8d7fa0f60349fce63145f

SHA1
9a38319e6283537fe4a639fa79b2372cfa44a90f

SHA256
def47db5e9fbe4d5924191d4230abf727c7bd1dca981952699a2d12c5b3c2b32

SHA512
76572e0409ec015640824bec185379515f9e52628cf3f5fb9235ac76389c98962192002fea624a5ef8d5be9f0a107552c51690d64024f6003e801ac460f4519a

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
254c7e4105bdbb1cdf9995c94fcc0739

SHA1
5096b5246c113da93d3bea1a4caaab2c4a35650e

SHA256
c4faf16854e346bd12832d1a23493b6fe1ac8d44aa0b92e3a50f9223e456d952

SHA512
fb5b8d1e77e57131262cd4a2cb7114b431e78bd1cd95cfada6ea48c3382bbadcaed92b25a6462c9b82d299efa30a64738aa720c703f30c7b7b59e86026007f2b

Download Submit
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes2.dex

Filesize
308KB

MD5
5e58845043089ee3b37392fec0f23992

SHA1
5e8290a1e9b734ae423aaa5f49bef8041545ebbc

SHA256
ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba

SHA512
84387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3

Download Submit
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes3.dex

Filesize
265KB

MD5
cc92d248d0c568e5351842d103bce7a9

SHA1
1d4950fe500f0789ca77fa4858ab8ebc3cb2441f

SHA256
0201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d

SHA512
a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7

Download Submit
/data/user/0/lansa.sis722.sers/app_cigar/dZxFW.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/lansa.sis722.sers/cache/logs/log.txt

Filesize
83B

MD5
30a0d16ff4c7b68f930843a08426df33

SHA1
7729700eed29e5afc23ae83484c04b053de061f3

SHA256
a9ff02a241853c06610757e004fb99cda490992cfcada3913a9ba95a4940610a

SHA512
cf236fff87cb96b13b71a59f985865ec7f34465348142a7cb5472aa3b9747f99797ff94df4c96004f593cba7e35258d17a1a2d2f7b0cb3f6f08bec95e16d0fcb

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads