Resubmissions
18/02/2025, 20:08
250218-ywn8bsxrc1 1024/01/2025, 04:44
250124-fcwh7azqas 1024/01/2025, 04:37
250124-e8zp2sznay 10Analysis
-
max time kernel
101s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24/01/2025, 04:44
General
-
Target
deper.apk
-
Size
6.8MB
-
MD5
2d34dbb4167ebb371e33f3ce700fdbc8
-
SHA1
4a20849866f90262f9a0b2793f84cc7d5e057656
-
SHA256
c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
-
SHA512
20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
-
SSDEEP
196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo
Malware Config
Extracted
trickmo
http://traktortany.org/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
lansa.sis722.sers1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59f765bbbb28171e35f6f17ee95ebdb90
SHA17bfb941907bea2a41e20f38e31c07566d8d3f7ef
SHA256c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83
SHA512144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5
-
Filesize
4.9MB
MD5cd652200aa24e4da945fcca01cf402ce
SHA1ec15238d8fa5f5906b1725965bb5eaef3f977172
SHA2566296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408
SHA5127d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d
-
Filesize
20KB
MD5e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA2566e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
SHA512443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD50da0ffd3e8af74bd246628f1eef0df89
SHA1d6b76e78cf7b13dca24955995ba460918a4a04b1
SHA256c345f075a41bb2bffb886d66689fd4019ac86770696b2f505f73af937f7e68fb
SHA5124a335461fe2384763e25f67869876f87db2c564c05dbbc54919fa86c07ad4a78d1005b5bb781d6c6ae892a33ca96701b22b316edb6b2ce9be7be655cc8086744
-
Filesize
8KB
MD5d19ca8ff3d941e50debc71f6380419b9
SHA1c143572c0369ed1174c8b3fd058c4892fd12a120
SHA25658dfcaed1f96dcade0a8f0fe363078e274d5cc58ac936e5259eedcfe0da08542
SHA512a04dc74b2731fc0d20e8b1d979af8d9668c9585473ed1d20cb997207487cf8e63fd2642815dec2e71fd935e82dd16b7ca3084b58eb3f5d3e1c7f0f67d56a4552
-
Filesize
8KB
MD5a1dcb1ea2f031058acde6579424c6fbb
SHA15cfbc7e43a0ebb24bdb5a7ebe77417f8ab5ada11
SHA256d17bc867f9b440b495526e0019c4dd810a809418fbf49be73dd55117ef6be493
SHA512939e8689d5db0482ec3f6a3e3d262b94b7799cb2c4f5c73e9295d305f5512b474a7c124d6609ae1e2823335eeaff7777113e71a4fb891d5d14a2571e6ccd6dc4
-
Filesize
256B
MD5205c9024aa3b2f52e53f6ab22171faae
SHA1ac2cf01fff3cf68c4eb88c8d44bffecc29848c2e
SHA2565068546bdb190d01febbc08fc7532fce99f5677326bea564c78869363fdc70d5
SHA5129a85ddf18caee8738ca84482b8a65bd31fe955d1f876e5c1f29866f0916e70eaf3632ff4afb936b9505569c24700398a96968762a9eae25dcc5889e840246569
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD56b439ca2461840fe61a6c5b3401d2edb
SHA1694b8ca26dc3c51960287d639d85f6c62ebd6163
SHA256f315e2b0d7efe3ee5b0a4223f1173eb38fd5cf8a3e115dd90e90d635156ad67d
SHA5125769e13e66b96051f46299de649cbcadf16d573033cd7a4a221a8196b30f0904709038d50714fa6e49b99b1bb23629d33fe8b0226a4a74a923735764ca2b1dee
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5a8faa3f43721737823e6e3fd919fb355
SHA1c473f674d343657cdc8e3e43f8b4e9cfa77fe813
SHA2562aaab0aad2d95733759f07c7b776f2dca7c2796ad92f2dcf106e9c167620d37c
SHA512abda59af41910a000de6c74316a5d72bb27e3edc0000218d5de6bcafc337c1ba69cba8ec2563b022e302e172e4e043e543ba81e34ee5d362a5575287810b4388
-
Filesize
16KB
MD5f40bbb4cf9ad1354dd0dd247ba0b07cc
SHA11b420c11c9761d380f112f1050c9a31573815b1f
SHA256c7d3718d7eacd55e283e4d0611441247059d43d22429674c35e769abc0657baa
SHA5120aaa31e7b1dc1b72927a5016c2609092bd1b60adea44cdee72acf8281a51777b77548183e501e01e03369adf2ad977b1ebfd20d2f422541754046c41a900ac1b
-
Filesize
108KB
MD5f2e2439957f1c5aed95c6902f9adb983
SHA125d75e20c81f8a3378ce35183573581649d4f1de
SHA256bca298efeae2060540fd93ece28054e0c2de54c2c59747841ed7badc8d01ce45
SHA5120c7aafe7bcabbfc58a1a590d20e89441b1b71194978c22181f4dc20123a9cd48ce8c2a7f4adb903f584518149390d79d0c1de4ead168c470637e855379c31966
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD55e58845043089ee3b37392fec0f23992
SHA15e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA256ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
SHA51284387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
-
Filesize
265KB
MD5cc92d248d0c568e5351842d103bce7a9
SHA11d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA2560201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
SHA512a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD517635b0fb7780b3dd956394b1113e18b
SHA18695745f70e28976a48aa5f6cf862129b6911f06
SHA25656bd48beb098ce348065f6086b641624b18ffb1353a8ba4bed819de0ccd5a860
SHA5124dc1ea9c9cdd738a98cd16bfa30832407caefbd778c7351172a827d971e8b698829033c5e8f9c2be3ccfbbd85dbadc8f3541ca72add2ceac253a283ddf5f954f