trickmo | a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1

Analysis

max time kernel
125s
max time network
152s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
28/01/2025, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.apk
Size 8.9MB
Sample250128-mc4ccsvrhz
SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
MD5 854aac2d7aee697954fdece07fab9e63
SHA1 5dba368280da2df4c06202c0676eaed6edde58ee
SHA512 fd6f066ed74ef83daadd90bfc9f0fb925063b398bcb5bfc2d14f70058b1bd899ebeed72c21e401d7ae8ef132366ec11e8b8b700ac5c447f6b02ca14cbb9a891a
SSDEEP 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://b-need-for-speed.online/u3n6hcu6te3b46gc

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json	4935	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex	4935	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex	4935	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex	4935	mattco.the534.hy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mattco.the534.hy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mattco.the534.hy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mattco.the534.hy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mattco.the534.hy

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mattco.the534.hy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	mattco.the534.hy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mattco.the534.hy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mattco.the534.hy

mattco.the534.hy
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4935

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 904f9cf93e321bcfd822815daa3059815937f7d5e78c26cd6f21a357e0ea381d
MD5 fe15ee99c3ec7641257b833794fa3b7d
SHA1 812ecad534b040cc179af3f88e706bfdb31f10a8
SHA512 fddea8d03e67fd5ee7e72042decb796c8a00b9acb0345226b856140bd5e3d4019957c0452c0389c9048bfef06cd6e020410468af6c53fbfeb88eafa966fcccb0
SSDEEP 98304:fjWGnKBcgAt52nKPgatSqjA1IYb3vYXIvCjFAN+BrI/q+JgjOK6s9u:fKGnKLAt5mKPgaAwAaMvYXIvCjFAwBLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 72c22429e8bc23d0e5ddd05fc4ff518fe8ba8d318489bad9246a98e86e28a0e5
MD5 fadc4334e5102b7c16022391d7690b2d
SHA1 59747dd0c1b3f801b20148107f8d8fd724d58088
SHA512 73d3cff0e7db04a73cea565ba571c661a4199509a7663319ce98d9eff4666288646937e9005096af4535782d00c96f0a7fa18a45836cb4f15382f6733f21dce9
SSDEEP 98304:+8ORHuOhwtXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnT:1IuiFA8p2mopLQBwTMzrbudT
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/mattco.the534.hy/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/mattco.the534.hy/databases/a
Size 20KB
SHA256 dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c
MD5 93e7f88ba7fd4f0152e8e5dc56f1acc0
SHA1 f29883585567a32fe4d487e5df14173c39c09e65
SHA512 be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745
SSDEEP 6:l9bNFlq4yl1Py4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLmPyNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 512B
SHA256 74d889552e048e3a262bccd46355b6efbb4714a0335976b879a59723aa81aad9
MD5 7306dcdb28a4e7cfb90ee3e570195207
SHA1 78e92ab034c92bed1060d2927599e0f8fed8b510
SHA512 900e666d6c269d2c264db3b26f0c4c16bc4f87de184003ffcc2febf7932f3dc615943f7e37a672d9a5bdfdcb22841d5551b05daca51172f6cd1ac2ac90658500
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 8KB
SHA256 c3ee6e0b85aab4811c5a50a49fbabbef18061c9227f79e3223e54adbb84862eb
MD5 a6cdd677450f8a83f6a70874dd183128
SHA1 8de403a05b80e6caaf5a252900beaa704383e8b7
SHA512 d7dcbc8b871e343e483f3f3614a8b90f88fd1ff480c848f209a0eba230d2076b71023087b2835f8a7ffebb985f754b6c96304fb11c364eefe5dda12010588e7e
SSDEEP 6:7+/l9ggn1o/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKp:7+tYfqLiuWdwRmBEyPby
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 8KB
SHA256 a848db13d462fc7115694eaf1d5d7ff715bb20cd9e39a83e007cd0605e2fdb1e
MD5 6743f7270b997e1ae7919f4eed447dde
SHA1 7dfbc647aa247a0dc4a1dca7c7cfeb984b1af869
SHA512 1dfca47e60cb9567ef1a5e4da94f6e746ba497d2d3ef0d4e58745f775d9e26c062e937f31e34738aa3549f150041071a059c71dfa11658e61f77b3d407acc7a2
SSDEEP 6:7+/l9u7l/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKXts//in:7+toh/4qLJdTRmBEyPbYsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mattco.the534.hy

Path /data/data/mattco.the534.hy/files/mattco.the534.hy
Size 256B
SHA256 905dfa106fa36cec4917287b0ae7174c27d48844f1f4b3279c0659329c28ad8b
MD5 e4c5612ed29bf3e414a8ee46e896ac5e
SHA1 58e53240b38cd061dcbe3f32e380fe6f83470ad7
SHA512 01f7c2978f12a84b29dffe5acc4d1e8307748ad45ab834529ab8e19544aee33b4c7e19ffea24afb7f1ae2e7ecc3f7e65a0f761d6126f43c715d5cdaf8a3f24b9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 6fdd9bd8111befd72261eb74bb0ea6cdb83de75cf31a90a7cd7e9a465c59f512
MD5 f58ea7372ae5ca7c19c771c548acc251
SHA1 8a4e96376e79290e2bc958e1649fda549f442c14
SHA512 b8dcf5f9a2da4783ca682ef98cc6c2108cb2bbf531a42306195d93178a2e7e24a7b414ab6218f0887dcafe30ffbfe785839392b140c866130485ed14016d2143
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 6884c9a4279b8101b1b0e6f827eca63a83757176139e7aab01fddeee7b141f00
MD5 0ae8fd9e1e0a5c8e2a2d963706050ceb
SHA1 3892d27776b99e15e222118792a8d6a504d00354
SHA512 78eda8ee956d73a9d70d7f6c0ddb4362a5054e2eb561beccf13ebae6db05eb996b7a0111a4b6b228d1adca7fd3cd43b48454a5eab0d308a4d39c97357a2f3fbf
SSDEEP 24:c2SXtY7SMnkSOkTUSKSFJlSRgSxSwSXtY5EESQaS/4Q:gtYVQkt5tY5Jv4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 07b4e7159118f8dcfa4e31d100c94d7892abf7f5514d9c1293046a1bb799b32b
MD5 3f61b9b1589185c47e17debc76520eda
SHA1 93d2e8eed6a8ae2a218e77f2ff6a194f8fa347bc
SHA512 cba499bade5e8bb191760feae323097d24441e91288eb5ddc43a9f54a7b5dc7a86e8244e989f38483aa5e861d16684245d67205380af4fd6998da01177872142
SSDEEP 6:KiLak5Ezv9FZdrlOERX4PBX4ogLugMBX4suuK+/gtTG6Wpd9D2Ypd9Q8iOw2:K4qzlzdTRmBEyPbP/7pL2YpziOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 58676df59a8444ba2be06cefe44a1fd61b2532c6b4b2a1440798c5d5f7fbdee0
MD5 afcdf6d433927e88c0fcebdd826c66b8
SHA1 08791d78c6f9639025c94b6acfea377be8fca224
SHA512 4a0dd24fc392c0355dc7e07f7ab9c7bbbd39855a2f9f06694bcb341340d11c3de3161f40cf06ab7eedee0d826f9ffd4490c693ae88d7921f920086489731cadb
SSDEEP 96:LA6+hdjnHtDRMpf8UzS6+BD8q0ExPIW/p60g:LkdjnHt9Mpf8UzS6+BD8q0E5P3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes2.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex
Size 308KB
SHA256 c7badc48a776508a577599400328f62689718c7c104bd73bc943527228e8805e
MD5 8cca423727967e8379ce383d0e494e6c
SHA1 6c000cd138d1b79ca6d4fdc3a2ad02568503c3fd
SHA512 95d7c9b72319e588a4f25b2933a1481bd0e35a8924542cb31a7879a90018a9cf6a13987ccc354271f7b4f20bef1e4a6f022578a32c5e3f10d82099661a48218b
SSDEEP 6144:cWXAovmwaOQX9MEQ0Aa9T6Jm59qw3mWzVc/ZfXlPPiaD8V9ZeE:cWn+JToE
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes3.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex
Size 265KB
SHA256 12f3ac501f79d828ee970ef7177d3e860657d70bd4dce492e2ec37dda081ae55
MD5 4a1b66fcee0fa959f8c93c00171bd168
SHA1 5b1554b54f6ec926e20a12084b2b2c9ab52cbb07
SHA512 85b0536bb9ce162c5db4f550bcb3753a48f34a607569cbe23b7cf14b288a9729fba063cf99fb6b606b19ff2c59b15d6fdbce411fc62a48bf9cf13953dbd686f5
SSDEEP 3072:4hJjEARYaigwju8ndWX1Layhk6MeS60sDhvkXFCb2T7/OOkqmGVFLO6qyjjNEj4Y:4hJ3fcy8GhjjS6yCb2TLOOpLO
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes4.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/mattco.the534.hy/cache/logs/log.txt
Size 83B
SHA256 83589455c18ba4af56832148bb224c864bb9e3286a120e98b98edb06640a6af7
MD5 0fd2f3dbd3320a0a2bd9d644015d12d0
SHA1 b70b7f05ea7d7acdc4c6d8248bb201322d3325e3
SHA512 2176fd1203e1d6e3a60539c8b4a585a5534dec011e7e858629f5b643cce140ce31996735ab18c3079278ae30804345f0c5579cfe91a0fe2c49991c739c374faa
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads