Resubmissions
18/02/2025, 20:08
250218-ywn8bsxrc1 1024/01/2025, 04:44
250124-fcwh7azqas 1024/01/2025, 04:37
250124-e8zp2sznay 10Analysis
-
max time kernel
12s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
24/01/2025, 04:44
General
-
Target
deper.apk
-
Size
6.8MB
-
MD5
2d34dbb4167ebb371e33f3ce700fdbc8
-
SHA1
4a20849866f90262f9a0b2793f84cc7d5e057656
-
SHA256
c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
-
SHA512
20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
-
SSDEEP
196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo
Malware Config
Extracted
trickmo
http://traktortany.org/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
lansa.sis722.sers1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59f765bbbb28171e35f6f17ee95ebdb90
SHA17bfb941907bea2a41e20f38e31c07566d8d3f7ef
SHA256c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83
SHA512144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5
-
Filesize
4.9MB
MD5cd652200aa24e4da945fcca01cf402ce
SHA1ec15238d8fa5f5906b1725965bb5eaef3f977172
SHA2566296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408
SHA5127d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d
-
Filesize
20KB
MD5e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA2566e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
SHA512443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
-
Filesize
20KB
MD56bbe3d122ebc0637f53f4957a6553397
SHA14f6c0fa8edd0b2a63b4481a9cc27fd45a1b4b395
SHA256944d4c9b4dfa5251432ff02c883d1bef28de875b9687997d1a26611de4443cfe
SHA512dfbfa07917e6986cbc2809960fcb6bb5cc046e16a5cbad9cd5bdc0787be14c17e946c502311f0e314c8090cf4dc6c7ff10318de90020dd6fb92e99529b4bb229
-
Filesize
512B
MD5a42d43098694555ccb6543ca0d68fdcd
SHA13dd90c26e8efc436db2501d4cfad707f956ab5bd
SHA256d83f55d9eeda9d1658eec0db48aef413ba0bc62a16ca7e4936659c1f52e07347
SHA51246c1cf2fae0f5a96aef5102b838b8cb1cee6de5d3f266dcb7feb8322117dffc8cdddd17cd9741cc1e57ed8d61ae3ed1793001591cb2721dbcd617ce479f00f77
-
Filesize
8KB
MD54e5c2936739eac620196cefdd34fb180
SHA1a2f1ede6437b5ea1e5ba668d44e769c66773834a
SHA256c11cc4937a52c48e04e841ff2f2b3bd1b43150317ea2e8b600df9c2ca867da77
SHA512ad63e2dd7d1dddd1893b28ec7b50919a76ce4401d305781ce52c02dcd142f3c27549dba30aada2f6ff09fd90593cf7ad4c6d76f08f1d9511a8df98c076d49041
-
Filesize
8KB
MD5e1ecfed05cfd56356038f7b98068f037
SHA1c2e55268247b07e013874e8b260ea79ea432f4fb
SHA2569325c3eb463ac9f42d685daec7c3787a85a6f3b0ccf62fc21c0be9921da7ff97
SHA5127477858cc3053b956a71d68cf847cfd2892ccf2dd9b43bcc158b07be45f6e877379b51098c73cf3583ae78e7984977b4ccf69901c8f64e7454d7c58387aa4093
-
Filesize
12KB
MD5ace90896ab1e18f07f869b9b34f36dcd
SHA145546a3f8dcc6a8379fe69e30afa2663975d602d
SHA25638f09f25b3d91a6d67431cd04561e9f7b492242326c8572758bf9d628d4d2c88
SHA51222486232d9b259b4f1d8d4179a63fa6190d4f87113990105a823f8c973566b7f44a758354916bd017cc21ecd4b19399f6652951d4e60a4b77a367421ba859bbd
-
Filesize
256B
MD56eb1e9277d327314b9212aa645992271
SHA19680e2f0587134eab9b2ba0543a6c95a56440c15
SHA256b0ccecb8dc938c5cdea9366d5c74e3e265e5cf117b9aa2aca214af406827a850
SHA51258a4f15d65765934bfa592ea17f185472e98049301b3813d7f59e154cb4c26f42cf92f4130131acfee482ab5ea22e7f0dbf462850f1ccdf690cbcd3ffc8d5660
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f521e0555081ef6b85af094125522ed0
SHA1178e2170094a8a187528971e94a9f96782fe8415
SHA25615d5a6bb6a688b5e9002bb09af365287264ac4a40509a6f76c846dfdd8c215a9
SHA51295d22f70eaaf661991f877f1851eb6f6d1769224c9d05a2a081da5335b58bd44c240c30137aae6353cd30caac80f59b0bed17400006d9eff51da3efbcdf92b95
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5622e8f0cf3c89ac98b398dc45f720668
SHA1e5e10106ccc5f3d7245ef07ae91440c590412914
SHA256778516f177d7add10ab25e64548c56a7f0a571523e39c183b724c0fa839bf9e3
SHA5121b7bf94e1751660281c3fa0c9b94b29165706126753ae487c8a81277c7c85a8dcf8a0d58623cf863f45e0bdb621ae34d81ace53c713873bad628c2b50513c135
-
Filesize
16KB
MD500e7482c2bd1522d08157c1e1a5c9d03
SHA16048145ea72d2128c826772179ea442cc89dd169
SHA2565928764037564d8b43a3e88bb488f3639f530d7ac375203488fd70caaec445b2
SHA512152ff9c241373603653f9a7d377b5e68b36905021437fe014178c9ca894d74646858e11cca6911f3d46fb4a4bc0c6e3c4ad22664ff5608caf82a1b144a59cc8f
-
Filesize
108KB
MD5a34a5c376ab7240c799d8845c676df2d
SHA1fea39cb4d17945fceff62c66f693be595d8a99a3
SHA2566420ccbb4530a60ae622577bb98e6f024e4e99183b6accb414778f00b0e9b83e
SHA512e8f7ed92eb262f6534d347407f040fcdd777537beb98251e3f9939898b5727b9e9d472bd2113fc3eb7eb401b01f808138420612f3492074ecafab8b51c08bb78
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD55e58845043089ee3b37392fec0f23992
SHA15e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA256ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
SHA51284387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
-
Filesize
265KB
MD5cc92d248d0c568e5351842d103bce7a9
SHA11d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA2560201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
SHA512a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63