Resubmissions
18/02/2025, 20:08
250218-ywn8bsxrc1 1024/01/2025, 04:44
250124-fcwh7azqas 1024/01/2025, 04:37
250124-e8zp2sznay 10Analysis
-
max time kernel
148s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
24/01/2025, 04:37
General
-
Target
deper.apk
-
Size
6.8MB
-
MD5
2d34dbb4167ebb371e33f3ce700fdbc8
-
SHA1
4a20849866f90262f9a0b2793f84cc7d5e057656
-
SHA256
c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
-
SHA512
20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
-
SSDEEP
196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo
Malware Config
Extracted
trickmo
http://traktortany.org/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
lansa.sis722.sers1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59f765bbbb28171e35f6f17ee95ebdb90
SHA17bfb941907bea2a41e20f38e31c07566d8d3f7ef
SHA256c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83
SHA512144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5
-
Filesize
4.9MB
MD5cd652200aa24e4da945fcca01cf402ce
SHA1ec15238d8fa5f5906b1725965bb5eaef3f977172
SHA2566296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408
SHA5127d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d
-
Filesize
20KB
MD5e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA2566e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
SHA512443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD517cf976d337788c240ad57862fa7ac10
SHA1e21574d54432a92be0355428043c94e46207521a
SHA256860e825a1c595561f674db01c703b8e4fed4b58737e012e95347d782f56dbfd4
SHA5129e0f568c41a981ea0d919325d3b6fe02a8c7fac1c82687967971ddcb69449dc6c0eefbba9342a4886e1540562256880b95cf63184075708894cd1995514df068
-
Filesize
8KB
MD511768bd95a62caef81abc2582407a62f
SHA10158590f40324aabcdfffdc19008694b0df92969
SHA256eaa43c409f09088c844a311bafa9422bb7b18b744583eb26051541e23c3b427f
SHA51259a5c5760d7f916b4e3d3086eefdd90b284d8f327a6ed07ca188f1d4f853b71203d6715aa868557ceb66f671cae6ec2138b7806acdea9e3c6b2baf04e90a365d
-
Filesize
8KB
MD559b24901a21b5c06c37d3c7ac55a09f6
SHA109f18781af73b2ca0a2c8991a9d923ae6b0c0461
SHA256bbbf97c78fc8c53f52b7a9ba86730b61bda1b6d0b9e26ab11c27236bca5f2235
SHA5121eeee99aeb2b012034e3dde3b700b508cf45e3aa7b3ba15aa3672b0bfa405fff98ff18ba78463c59bb8ecb50cfce02d1c7228bb19663778d7cfad52661275016
-
Filesize
256B
MD5614369391979f4bfe611f85698967dbb
SHA17a00d0c9c71bfa0d7d466a54f470ee7caa036a78
SHA256c2d865c80fa55dd28b2d32b166812b4cb54b11d3c318078be4d7f60a42186e30
SHA512cee08f8decba4394bba995ee52302c1162d2286bef4f7881a440fc42939af154f9064a659c6bc9c51f7ae654819326c6114641b5dad7c3b1ffa0369732ed2a91
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD54b6788262a1687a11f5e7d3e9c233e5d
SHA10f19b47d45c6314d0e01ebe8409ecca7878d23a3
SHA2564b7775a7cdb567d8c1bbd2bb7741cdb98b72a041153949e256de0ffec975d92c
SHA5122c607c74d95d6377a4226574b70af9dd509223ba33a51bea8a712accc9df1d06c1e441e91ba53dc21ec947c2a44f05b4734d7f9edaa5b5e554c9adfb6352be73
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD515d6f4690d10426f32fa1e9d95eba0c6
SHA1812c3e447c8168ba4ffd7f3ccbbd9ec3df4b1c43
SHA25678e2f7e8ac4d8c711ab1d4ddfd2c41fbf71515e284ac171ec3a508bfa9ad4951
SHA512cf1a4cafc930f68737f08a8b15ceca1a8f9f9124a2bbf081cb1274c49a7eea9929e8236c5dcb8cb5a6708a183546d0e272a6c489ddace29bf9f3526151d40f57
-
Filesize
16KB
MD528f6c30c3e03f89cef41da422a6f46d0
SHA1c29664a69cf25ab55d4c8898471c265ddf273e9f
SHA256f66d1ce2cb97cbeb7b1ac2fad43fd8a56082df15e5502677d2c01639954905d9
SHA5128973d7bec2a7f66dd210ff9ee5368e4a022951e902c6721ea82f0634294f024bdd02ffe5e3bb074921fcf7b466b40b41d243dfe8df20ce195396ac24ce3c9e0c
-
Filesize
108KB
MD5aac394aae9124ee4f52790beadf34e9c
SHA1f11064cb520a5dffa52696fe6e0cc5e8b499f77c
SHA256d05cbf7e969c2292da58db6e6c7a711aec2e03be8d88e9d8a275faa47106bfbe
SHA512fd4de52531da72b27036d8a38eb491c8b4c1dfeb0224cdde99523659a524a31597fc06431195f7f82c9b805de45a59a38d927f3ab0aa65553983e36b41a80105
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD55e58845043089ee3b37392fec0f23992
SHA15e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA256ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
SHA51284387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
-
Filesize
265KB
MD5cc92d248d0c568e5351842d103bce7a9
SHA11d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA2560201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
SHA512a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5bda6406265321e3bfd2db41f116e18a6
SHA1063145a9d1155e26fca16c58f1eeb5cd1ca64c0a
SHA256f1b9fa9477f55060c81cd96f0d1161fa70f37a01694eb450d102db14365bce8b
SHA5120b85139d8cf28e4b006607cdccca036a2ad9de93e7ca72dd4a8398b529d5b0402926a38215f51eeb9399b17c86192adaeda713b7a0baad15ef71808641eb74c0