trickmo | a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1

Analysis

max time kernel
125s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
28/01/2025, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.apk
Size 8.9MB
Sample250128-mc4ccsvrhz
SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
MD5 854aac2d7aee697954fdece07fab9e63
SHA1 5dba368280da2df4c06202c0676eaed6edde58ee
SHA512 fd6f066ed74ef83daadd90bfc9f0fb925063b398bcb5bfc2d14f70058b1bd899ebeed72c21e401d7ae8ef132366ec11e8b8b700ac5c447f6b02ca14cbb9a891a
SSDEEP 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://b-need-for-speed.online/u3n6hcu6te3b46gc

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json	4336	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/mattco.the534.hy/app_bicycle/oat/x86/lZAh.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex	4336	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/mattco.the534.hy/app_bicycle/oat/x86/lZAh.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex	4336	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/mattco.the534.hy/app_bicycle/oat/x86/lZAh.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex	4336	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/mattco.the534.hy/app_bicycle/oat/x86/lZAh.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json	4310	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex	4310	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex	4310	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex	4310	mattco.the534.hy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mattco.the534.hy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mattco.the534.hy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mattco.the534.hy

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mattco.the534.hy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	mattco.the534.hy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mattco.the534.hy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mattco.the534.hy

mattco.the534.hy
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4310
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/mattco.the534.hy/app_bicycle/oat/x86/lZAh.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4336

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 904f9cf93e321bcfd822815daa3059815937f7d5e78c26cd6f21a357e0ea381d
MD5 fe15ee99c3ec7641257b833794fa3b7d
SHA1 812ecad534b040cc179af3f88e706bfdb31f10a8
SHA512 fddea8d03e67fd5ee7e72042decb796c8a00b9acb0345226b856140bd5e3d4019957c0452c0389c9048bfef06cd6e020410468af6c53fbfeb88eafa966fcccb0
SSDEEP 98304:fjWGnKBcgAt52nKPgatSqjA1IYb3vYXIvCjFAN+BrI/q+JgjOK6s9u:fKGnKLAt5mKPgaAwAaMvYXIvCjFAwBLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 72c22429e8bc23d0e5ddd05fc4ff518fe8ba8d318489bad9246a98e86e28a0e5
MD5 fadc4334e5102b7c16022391d7690b2d
SHA1 59747dd0c1b3f801b20148107f8d8fd724d58088
SHA512 73d3cff0e7db04a73cea565ba571c661a4199509a7663319ce98d9eff4666288646937e9005096af4535782d00c96f0a7fa18a45836cb4f15382f6733f21dce9
SSDEEP 98304:+8ORHuOhwtXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnT:1IuiFA8p2mopLQBwTMzrbudT
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/mattco.the534.hy/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 512B
SHA256 461c4b64cbf3c82caca8443e2948c81b9d84ccc9610cb254fc3f8e9e9566d34a
MD5 3086420bf6b28b0c0033dc7b033a65bc
SHA1 7d7f5607aeff365fd0b0fc67f31830f1ee6c8422
SHA512 8d45c88e334c40a90d7c25538db84756fa1b372bf6dde644fa0ade447ed70e559d93fc25072adde431f7f7b388f79e74417593980f2421d33882bd13531318b7
MD5 SHA1 SHA512

Submit Download

a-wal

Path /data/data/mattco.the534.hy/databases/a-wal
Size 32KB
SHA256 fbc39b860d6258a9974401743e0bab620b1d6a7c50f11a92e6497a5b5098cf0b
MD5 c3bc154511b69e3da93ec95e88771a25
SHA1 f3d64e1ea5970350e202dba228654c251aa1ad29
SHA512 f714fa35260b8fde5b3a319200b2f2b4d0da57f97bbb3a714b62b285c1ced3e833944694e9397aa7fffb51d005bfc2091661c0e3f51fd3baecbe15d9ba377ce5
SSDEEP 12:KNGie8zdTRmBEyPbP/XqDmNiOwCl+seDqyNTSFbyiyuE9dMARmBEyPbP/XL/x8Ms:Ki8zyGSP/jwFTEPjGSP/T0
MD5 SHA1 SHA512 SSDEEP

Submit Download

mattco.the534.hy

Path /data/data/mattco.the534.hy/files/mattco.the534.hy
Size 256B
SHA256 2ccb04d371c4175f30519b2c3e3774cc0cbb858fb5c8a92edd8f35f419f796ea
MD5 fbaa4666951ea6ec9dde8c6e0dd6415c
SHA1 2e574f1bf4dc6840a1a840dc052d60b5a20c4c07
SHA512 16835253ddd8a2394384d98e3d30819589d3a81a7f31d42cf12e3c1b5ab6898f6ac6de73a4a87b0aac03554d4eba6aa5b7765d5588908bb97c8f362f2e260be9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 43e5381bb0c98c58ebb81b73e8e6d865e8ccda960025f059341285a8a5a319ae
MD5 75b5d18663270ed101b80d43046163a4
SHA1 ee0f387e2fe3dd864ec7fc17d9d6036f2b1c2e1d
SHA512 293fa9faf59cb12edc4ac2a7271f9414c061f6c33f8d3806e22e283370a20ccc68f771c6477d60590867518924281ab7fbf1e2bf2cc3b3bd81e08f834adedd33
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 a651acbb5913d752a98037f471e79f1daca0c13db34ad06d6f015537c5c1bca7
MD5 66f687a5b8d5abcc19369e50083a5cd6
SHA1 dc0b877b7210e1874dd4965584238495d1fcb95f
SHA512 2f79397fd4c9fb2183cfe73b740dbd13a37d2a780e18b6ca0babb46b4104e456396fb33e41b1b1f8c5ba1fa1e62e7822560682587e53fc93eb731e4e62bbef02
SSDEEP 48:E9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI95:y6+hdjnHtDRMpf8UzS6+BD8q0ExP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 f166722f4f354ad3affb9697969923ee2e2f430dc2c0a040c3c8954f9c30139b
MD5 732f6c453450c9717384c8413f7ca813
SHA1 446f54db8c0855c762bf1c65f29cd454877ba3f8
SHA512 7a731b96681c7c20ea7ec4c68b96dad2560f76899c02e4bdf4e3629c50ff2eab0beedb3ed5f9b3810bcb28751318652f5e7d6c3dd06832769054f327c0846aec
SSDEEP 24:sKC1ktY+C3yIC/PT4C+CNUJhCzSCpCaC1ktY5g3H3CQnCaeT:I1ktYXCFXRXNMIzLgj1ktY5ASQCdT
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 188f522738e7ffee8dbd7f92c72bc33cfc3e78910667fe3d0664c8c1f47edc4f
MD5 34f67f2c7527563f89fa5d1e9ebd4893
SHA1 136b7af5782b85fbe5e0c849599a315992f10d5a
SHA512 8a73552ffa7753b5c8d7f1f0e4cec5a3b875860631eb15b36a53514927535171ca1cbb4b5d3d92ea1d969698074d162d3e92f5e0b653d79528cf6c16480b88fb
SSDEEP 6:KKcw1HG+vv9FZdrlOERX4PBX4ogLugMBX4suuK+/T649qf4Ow2:KW1HfvlzdTRmBEyPbP/x9S4Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes2.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex
Size 308KB
SHA256 c7badc48a776508a577599400328f62689718c7c104bd73bc943527228e8805e
MD5 8cca423727967e8379ce383d0e494e6c
SHA1 6c000cd138d1b79ca6d4fdc3a2ad02568503c3fd
SHA512 95d7c9b72319e588a4f25b2933a1481bd0e35a8924542cb31a7879a90018a9cf6a13987ccc354271f7b4f20bef1e4a6f022578a32c5e3f10d82099661a48218b
SSDEEP 6144:cWXAovmwaOQX9MEQ0Aa9T6Jm59qw3mWzVc/ZfXlPPiaD8V9ZeE:cWn+JToE
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes3.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex
Size 265KB
SHA256 12f3ac501f79d828ee970ef7177d3e860657d70bd4dce492e2ec37dda081ae55
MD5 4a1b66fcee0fa959f8c93c00171bd168
SHA1 5b1554b54f6ec926e20a12084b2b2c9ab52cbb07
SHA512 85b0536bb9ce162c5db4f550bcb3753a48f34a607569cbe23b7cf14b288a9729fba063cf99fb6b606b19ff2c59b15d6fdbce411fc62a48bf9cf13953dbd686f5
SSDEEP 3072:4hJjEARYaigwju8ndWX1Layhk6MeS60sDhvkXFCb2T7/OOkqmGVFLO6qyjjNEj4Y:4hJ3fcy8GhjjS6yCb2TLOOpLO
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes4.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/mattco.the534.hy/cache/logs/log.txt
Size 83B
SHA256 578223e317e83fa040ef8d7202c95a2c1b32ee5755e9a64474de05e9f58c526e
MD5 af33b77a96f114481fecc6b670e9f925
SHA1 922e38fc49ee7fb2823d69ea918ae0f906f8c538
SHA512 9f90d603be591c9925b54ffbadf17343d217c57e14630f34dca386ee5d97e940d90aa88873524d11cbb89259f43c71fe46174dda9bb9ae94d0df92a925eb9d57
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads