trickmo | a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1

Analysis

max time kernel
138s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28/01/2025, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.apk
Size 8.9MB
Sample250128-mc4ccsvrhz
SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
MD5 854aac2d7aee697954fdece07fab9e63
SHA1 5dba368280da2df4c06202c0676eaed6edde58ee
SHA512 fd6f066ed74ef83daadd90bfc9f0fb925063b398bcb5bfc2d14f70058b1bd899ebeed72c21e401d7ae8ef132366ec11e8b8b700ac5c447f6b02ca14cbb9a891a
SSDEEP 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://b-need-for-speed.online/u3n6hcu6te3b46gc

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json	4476	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex	4476	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex	4476	mattco.the534.hy
/data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex	4476	mattco.the534.hy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mattco.the534.hy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mattco.the534.hy

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mattco.the534.hy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	mattco.the534.hy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mattco.the534.hy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mattco.the534.hy

mattco.the534.hy
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4476

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 904f9cf93e321bcfd822815daa3059815937f7d5e78c26cd6f21a357e0ea381d
MD5 fe15ee99c3ec7641257b833794fa3b7d
SHA1 812ecad534b040cc179af3f88e706bfdb31f10a8
SHA512 fddea8d03e67fd5ee7e72042decb796c8a00b9acb0345226b856140bd5e3d4019957c0452c0389c9048bfef06cd6e020410468af6c53fbfeb88eafa966fcccb0
SSDEEP 98304:fjWGnKBcgAt52nKPgatSqjA1IYb3vYXIvCjFAN+BrI/q+JgjOK6s9u:fKGnKLAt5mKPgaAwAaMvYXIvCjFAwBLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/data/mattco.the534.hy/app_bicycle/lZAh.json
Size 4.9MB
SHA256 72c22429e8bc23d0e5ddd05fc4ff518fe8ba8d318489bad9246a98e86e28a0e5
MD5 fadc4334e5102b7c16022391d7690b2d
SHA1 59747dd0c1b3f801b20148107f8d8fd724d58088
SHA512 73d3cff0e7db04a73cea565ba571c661a4199509a7663319ce98d9eff4666288646937e9005096af4535782d00c96f0a7fa18a45836cb4f15382f6733f21dce9
SSDEEP 98304:+8ORHuOhwtXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnT:1IuiFA8p2mopLQBwTMzrbudT
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/mattco.the534.hy/cache/clicker.json
Size 17KB
SHA256 32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
MD5 d780f836fe54e51872bf31220a4dcb77
SHA1 5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA512 62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
SSDEEP 384:IrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:Irlpl6Vn4RNTSmtBcv5+40fJDy9k0tnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/mattco.the534.hy/databases/a
Size 20KB
SHA256 49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
MD5 57baf3e42a94e8dd82e267b2f0619330
SHA1 76512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA512 227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
SSDEEP 12:TLmaEyNTSFbyiyuE9dMARmBEyPbAVOwG:TLXREPjGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 512B
SHA256 24974c6658fc5c2071fbefaf59a863c77f691d1b2acfedb4fb28c4faff239f72
MD5 50816914867ee4f6d3ac1a157a62839e
SHA1 8c028b5cde311c8f98d1e4113fbc646618796c8b
SHA512 89c66529ea87daca2d86dd0108fd287dd48c30e8009521957fb169f9558c775176ff223d8436e56c95a476609eeb8ee3541611a85a31eae197216906fd1df282
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 8KB
SHA256 7edea702ac3e87f849c6739169843652651c70944a16f1ad9c2f91d2229f4070
MD5 f806b0b6f598201a82d69221c4a84980
SHA1 45c8fbb5d1f80cfcbdf43710d542d565e0fb3e3f
SHA512 16905cbd09355afd726ce13170e9d420214e62b4d0c8a86f8600ec0410ecc2622e837659d690b6c7e0e3a4e14b9d6743c49e95ab94a534226f5b7f68e15b23c5
SSDEEP 6:7+/l93Hn1d2vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKue:7+tZ2vqLiuWdYRmBEyPbfe
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/mattco.the534.hy/databases/a-journal
Size 8KB
SHA256 bc88d175e0944b001dbf3f0787e0c58fc089433074d4ae033b11e977095da819
MD5 1dc198feb221fd06cd767ec28ce47d14
SHA1 5174c10e378e9bdcf156ab8ef87bc8799cef9933
SHA512 ff4f6f23a1f8d97d0bb3876190242b3d267f4c4bade6a4adae1fbe7e8f2bd47142431510a0d328128fe31f681385b93d0b518d6332d99c2a913342adfccd08d6
SSDEEP 6:7+/l9irFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKQ/Gl//L:7+tY1qLJdeWRmBEyPbN/GlXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

mattco.the534.hy

Path /data/data/mattco.the534.hy/files/mattco.the534.hy
Size 256B
SHA256 43c0a0ffd73b74f0a0e33aa1c30565bfe8e8e3868ae90d192934ebd9cfd7e6df
MD5 5b201091553899bfd78c74b09401b774
SHA1 a2821595f1ac92fa5d39dd8e7812d2950d3ce53c
SHA512 62340dbb8b20eeefe5f7fed1bc8ffe18da6baa71ec90469f12602cb206d8fc73125ebf5103ea8a0f307f8fdf0d8556171630daa1aaacd0f81a3e26183372e327
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 ac653e3d8329d6c18f5bba22a9b7d325224a079ba210c9670a10bab57f87b25f
MD5 80a631e9696b113e5cecb89ab6d4fedf
SHA1 5cb655da9be32ff09971d36f1fab3d03d0edb93f
SHA512 b489646b5106511088b7e4cb66fbd1f8538cb7aff2457c6182a093b1e9de577410ad702a60c73fead515d3d55e5251bdead64fa7e904be1921a4dd9826caeb9c
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 2dc8e9ef0d79def96da2a6a5db181b5b4c3fbd0cbf5321d3603b5f68eedb8d21
MD5 aafc3f3f55beef5a42bc2b2a4fdbf650
SHA1 36c8ff474d5efdc93f376b29a299260e2d163b85
SHA512 b75a62caaf24831dabb17ba75ab1d93184f9a7964bb219b3d9e7e7a2f71dd769edfc7816328a64d7ff07d216d22f3015a9069a4085b8943dbbe68fecc4706286
SSDEEP 48:9iutY6Sf2lnzkXOUeQRjK6VOtY5BUPb/+7:dtYqZl6stYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 c1db115af83c670b2d28b1fc8f266accf18fd5e232f6b7a4e29a0b02b819a7d7
MD5 d6c1990663dad6791217db63a9b52181
SHA1 7dcbe4a008c50d72d72a8a7eb1e00ab0456bc47e
SHA512 86d4860067fbc5e3fb99e6f1c7cab002c72bf2fbcd91aecac384ed120b56abd25bab2adffa044bd43d7ccb6b27d646739113249b21da0994caa7fa4b53a58a62
SSDEEP 6:KwsQl5Os/J9FZde/kPlOERX4PBX4ogLugMBX4suuK+/SshmJ5IWOw2:KzIfzdeWRmBEyPbP/VgJ5FOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/mattco.the534.hy/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 907c7435fe69871844980224924dd2a03f959b20b9bd4164cc1fadff266471f4
MD5 89166fa5e40aa78ba879742bf5e5bd05
SHA1 0e08ab6f80cd6f9b17a82acf81390e5318d103ad
SHA512 a858d5457f7edbe2985e21e9efac7fb44f737d706d6690cadb508a5714b9265caef172ccbaa496133e3b1c051a7cda617fb506c2582c25f3a2b257edd00546c2
SSDEEP 48:eRFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchIX:e6+hdjnHtDRMpf8UzS6+BD8q0ExPhtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZAh.json

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes2.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes2.dex
Size 308KB
SHA256 c7badc48a776508a577599400328f62689718c7c104bd73bc943527228e8805e
MD5 8cca423727967e8379ce383d0e494e6c
SHA1 6c000cd138d1b79ca6d4fdc3a2ad02568503c3fd
SHA512 95d7c9b72319e588a4f25b2933a1481bd0e35a8924542cb31a7879a90018a9cf6a13987ccc354271f7b4f20bef1e4a6f022578a32c5e3f10d82099661a48218b
SSDEEP 6144:cWXAovmwaOQX9MEQ0Aa9T6Jm59qw3mWzVc/ZfXlPPiaD8V9ZeE:cWn+JToE
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes3.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes3.dex
Size 265KB
SHA256 12f3ac501f79d828ee970ef7177d3e860657d70bd4dce492e2ec37dda081ae55
MD5 4a1b66fcee0fa959f8c93c00171bd168
SHA1 5b1554b54f6ec926e20a12084b2b2c9ab52cbb07
SHA512 85b0536bb9ce162c5db4f550bcb3753a48f34a607569cbe23b7cf14b288a9729fba063cf99fb6b606b19ff2c59b15d6fdbce411fc62a48bf9cf13953dbd686f5
SSDEEP 3072:4hJjEARYaigwju8ndWX1Layhk6MeS60sDhvkXFCb2T7/OOkqmGVFLO6qyjjNEj4Y:4hJ3fcy8GhjjS6yCb2TLOOpLO
MD5 SHA1 SHA512 SSDEEP

Download

lZAh.json!classes4.dex

Path /data/user/0/mattco.the534.hy/app_bicycle/lZAh.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/mattco.the534.hy/cache/logs/log.txt
Size 83B
SHA256 60a0ed36e05ddf6529b4dfb9de17daadaeae20886d7e635796e921e5dc365553
MD5 424da3999d643cb7d6be8318227ee7da
SHA1 b56afac853ad5637523e6f716a9c7c8c2c90337b
SHA512 fcd9db89b8f8abbb8faa8b1f030c69c416a0a2e8aada2da52324c3911c510e17cbad222971e9105e2b29e6a7b42b5c93dcc4993c6ce634a1ec909d767cec7fa7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads