trickmo | cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0

Resubmissions

05/02/2025, 11:04

250205-m584bavngp 10

05/02/2025, 11:01

250205-m4n2ravnbr 10

05/02/2025, 10:18

250205-mcbmcatmck 10

Analysis

max time kernel
117s
max time network
119s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
05/02/2025, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0.apk
Size

8.1MB
MD5

c889e75eb26de5a53531ca1d799a777e
SHA1

4c9ae2c8bc9a2bc02926ee2a9a49730881907a69
SHA256

cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0
SHA512

cbe94441f6ea06b1c9c9de0933e9755d3ac7deb3197d795570cde4d0680c87f25c8c3e34c189a8b8d898b8afa9140093dfbf731852cbc6bf02cfc03c00bd5941
SSDEEP

196608:5erveQWOfAMidD+traG/iYVS9MEY2HWv7ecSb5xW:47eQqMidD+hjpVSe/2Uu2

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://mainworkapp.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/aner.fos540.ex/app_fragile/py.json	4495	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes2.dex	4495	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes3.dex	4495	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes4.dex	4495	aner.fos540.ex

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	aner.fos540.ex

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	aner.fos540.ex

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	aner.fos540.ex

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	aner.fos540.ex

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	aner.fos540.ex

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	aner.fos540.ex

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	aner.fos540.ex

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	aner.fos540.ex

aner.fos540.ex
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4495

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/aner.fos540.ex/app_fragile/py.json

Filesize
4.9MB

MD5
aae2fff1e66e2ed7098e6a244c9fafc9

SHA1
cb45aa08a26f26d57e4ff2c38c87445baddd88bf

SHA256
1f4ecd2ff4e128f1ff3da8e59d77d3b64eda9ba8514d76abae1f786bbe65420b

SHA512
757310e3bb6855040b4b2a631f221e806721f5666257add6bf834c29b37a19fb953c42d3d04bbeedcd53d1ae1a2337bc61e36db046e46f1de18103e324fefb73

Download Submit
/data/data/aner.fos540.ex/app_fragile/py.json

Filesize
4.9MB

MD5
ad4a8dddb4b956662516a5353912f97c

SHA1
52b4eee991f8eac17572bc57f2b06dba9a6fddce

SHA256
19fd2538eb94df4e5713d9bca304527c08f27a84118ee583fc263cda1ef3b10d

SHA512
37ce05314e1e2a0edbe07f91208265e3c35a63142da54f60732736aa9cb8201dc78025682cb489e0e607826a21df38932ddbaa199fc86d246a91f42a614b2dd4

Download Submit
/data/data/aner.fos540.ex/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/aner.fos540.ex/databases/a

Filesize
20KB

MD5
91af32c14839a2828ca58297e0861362

SHA1
bd758cc0bb47b570da2061d4633aa998a87ed971

SHA256
5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923

SHA512
9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7

Download Submit
/data/data/aner.fos540.ex/databases/a

Filesize
20KB

MD5
87c561dccb2568e72052045b01d46d20

SHA1
9b81e5cc56b6d15fab7ba4162c2685887d2cd934

SHA256
ad99d061f4ceeeaede928a03baa1c67d9831745b2260ee9fdf64a2423a899022

SHA512
24548eeb6649959fe67f5b9795585d43ff262ebc942343f0706e5cf372d6bc380fe4ef4fa35db615a60b5f2e4aa47d4ec4a32ea0ac382c573511c3712f97f051

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
512B

MD5
cd26bb18b60837d2afd90d1b4751b11c

SHA1
5f4649dce241da0867d80a18ee2cd67c57f9c82d

SHA256
ec325a794267a0c07ddb400f577970302db1fcedf47381049e936a38d8dd772a

SHA512
2a56b585dce8e9d9dcc24ca9a95675faee73ee60544d0e6a3a27aac9d811b7d258088ae0d84ee35a19d450899d31a3c6083fa467d35dd267e4b755a588452685

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
8KB

MD5
95c3893df5908fbef7b546abf14c1147

SHA1
dbdb1a4d4cf978075f160e9f86dffa25beb7973d

SHA256
8e45aa9ce7b60e92ba0b1a0eab71530ecb74e275b97bb6e24a19363c7af5092a

SHA512
1ad0419e61ca50232826dac57fba3b0234d7a3298618f2447c7976fdeb5cb742d82b0dcc2cd79e59703f7a876e71b24921d6dadbb72a56fdf14509b621304486

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
8KB

MD5
f533c50c01710d6a1be754fe68dc3c37

SHA1
c107a5e5ff7e376ccc352257e5a2095dc710d401

SHA256
75dd6aab2349eaeb38c9dee0e6968a44f3118f30f8c49ea2e3ea376b6d4bc87c

SHA512
5cb9969bd21bd241b7e679d125eea2789b6ab4606717da2fde17c9108b654b734bed9bebe6e4b899f2bf9964f64f6af3902fb4410c74390b70990702d8b20386

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
12KB

MD5
3ab1bdf38484900d5ba0055c08d5c17b

SHA1
4e913ae7b0da0da5e5d973d3d94e873d1af0f9c4

SHA256
70b9f275bfeefe478baf5efbc01b126c3dce538e7514a13e400d8116ad54a90b

SHA512
02eb21d192da6e7c5840ed9ab4d7864a6bc6a83071e3b43eede18d3ce98d187c10be43af88ffa958f0301286e8dcdf99ac762b2c74e3d2c4088a393ad22d2d78

Download Submit
/data/data/aner.fos540.ex/files/aner.fos540.ex

Filesize
256B

MD5
407081bbf72c62c622b64014be8fc4c8

SHA1
d714ff2a95fbfdd2075e469f005a1417950ada9b

SHA256
65dd62faa6f3691794de90a7d3d772796f68145dfac7a3ca914896176d26f986

SHA512
ae2a7a6d86302788364eeb7a20931d399908649791baecf83142b39bdbd5fb587132b2f1e793dd40fc827ad39ae441eaf36172725a966963ac895aac784d11d4

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
83231569c8425880ff487d4af65e7c4b

SHA1
c663573c1ccf89088bc733c0e23291ec0dfc1ad3

SHA256
c7168b9be1843ff1aafe809c96ffc4545b7a437caee46ba39c351d5d272ac3ef

SHA512
5951f4b40b11233987a7ff0a0ed18c6424e1ade40df1ad4a9d89dd4be004adc39863b98e75aabcf888aeada4cd2f980acc3c2f5f00e1dda4ce199cae95ff7854

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
5f9482a6f68df0561bdea7cbdf809203

SHA1
f62f7e9467428855b6be1206410aaad1257dc014

SHA256
43fe1ae798e5c671beb3d258a1696f580146b8478287f0b8551591cc8617487e

SHA512
f3355d2021481b1fdc697af68bfc5af13a94386e0df4faeb11ad902fd321dd0492fe34fbeea521aedae6e73d1a38cedfb30e44cd4cc710ca6e64f4fdaee592db

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2cb61943da8e2a6318110ff951c0dc26

SHA1
e15df52ea2f48da191ad385e234b4eaeef8e0d6a

SHA256
d558f633e7d21a1c9570210fb0fde53507b4b30c1b6a92615c3e61849540702a

SHA512
0689b8a1a34d9e1b01afbc5a2becc51e3084d73ef9df3095258bb9972f89618f9fa0839a7cceea3a7b99febf3e2d7b08a2f9afe71be57f17b9c2a4077cc8c00c

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0daa71f22fb9e308504a815fa8c5fe86

SHA1
070bfb94a0ae96b1989b12a735a916f1cafd606f

SHA256
2c222da2db4a36a0dd092acdca86c46efe3a602751b3cf887b2963235d0947bd

SHA512
14e3e52f80edcc819f30b5980d2b01c9a84d55f95384c2f9900f318ba6fe501fe2f54374655b821fe7b3e5e766b8a15426edb7f12aa94719e395e0149cbe6979

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes2.dex

Filesize
308KB

MD5
87fbf4277c7b1354b07ab66e7841e5fc

SHA1
f171167c1e22209bfe6f8e826763fbba7e2dd195

SHA256
d604f9e58075636656da343d9efe1c1af4f225def49e4d288fc8a7442cb07555

SHA512
c74f9f44d6b8d4b3c78b79a2710b66ebf851c6401b8e01926f910e44e4be7ce911286b385558797802eba7ae26b0d0ed06faee79e9e8bbe8ca798f7ce4e4f9fa

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes3.dex

Filesize
264KB

MD5
336b36c9bac9108ef167e46ecd780cf8

SHA1
2f2053b4858cbc16a7fd71634187b829e816e3ec

SHA256
f144ad2da806b72948617d8d35426c21fb682d58c20c5002b3d41eefd80a07b2

SHA512
faaee8913953353783666ec7917e9cbb6774c024369e069de530904a3664cd96ddf7bb0a4b261f7aa8458b33028b39c3af7d66fb62bd3885e7f7fde001c67401

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/logs/log.txt

Filesize
83B

MD5
9c11a5421b1c52d09f09291e434d76c0

SHA1
2077a53a4ac6392486abbbda5292a1a06c17911e

SHA256
1488c7eae895bf617f2abf8974bbdcc21abeba6220e33182fdfadaa1812e594d

SHA512
158b8ced68521f691fde36e1f4db6248ed8feb99099ffe3fd8abb5e31a30f85b6998d2de27b7bcbf18f514a785d1d259f57759af90450ab8aa44fb8fc5996306

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
71KB

MD5
6bb81bb9b86af2749f3b5ccfa754449a

SHA1
53da514e11ec20aada52ba616675917228352ccd

SHA256
af7c45c8c17f5125f50c3b4e96534e85fcf56f8ae3d5cdb0b734fee1eec6b8f3

SHA512
2c62af9b7a5994b8a24394649a887e98a2d9275d750d44b38b03704e7582856223ebedaa18f5a8d06d91e8e83c70819e6c08f0e0371c445a5d1bc6e9959d92f4

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
107KB

MD5
f42a2a1eb4585ed10dc647cc0b5e9c41

SHA1
ab6b23f28d586f1aa89f24cf74ebd5029a72d37c

SHA256
6a04faca4590674217d21c3b983081752a10e7b1f5124123d30240e2bd44386e

SHA512
2aad7893b9e458704fcad89e7d10e3ad6b2ccebfa2da75ec221ff46be7821a879b63d9f2cff78bd641943f0366e14df8ff870aafa2dfa220af0a7c2f516bf239

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
143KB

MD5
fd25ee1343dd78be5f1ffaca4bec8831

SHA1
814c906aa2f5a939c623413fbace6db5043a103c

SHA256
45d900b4d261cb5a296e9e2d470235fc72b464c11f623b6a25bd85acc251c2a3

SHA512
53037b1a47313e4e547ca83797f767668f668aaa95a5528dab42afc555e390f633fce58e1c07a2b33c4bfb844a0d5ddf3e046d9910b5cea06fc71e55e0d0aac5

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
179KB

MD5
b79e58249c10b2a441d7fff74f6dceca

SHA1
928e99ded600a6c1d0d72cd10497bb8f05439ba4

SHA256
c9cf057d4d3a95e8e5840cfb0fbc08ae19d9d185d427721706ff60a325ee9670

SHA512
2be594d6b93205cca4f4941457abcb359e6cac8fe2ba8b569fccecae2a1a70985afdfccac017aa1c58238e0cf1558ebbc933b1f0ac890d61a55cec36548c9cdf

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
215KB

MD5
7efc8165c93aaff912afe996ed6eb8de

SHA1
80f8bbea99285c469fefce135201e39cfa0daa1b

SHA256
179b8e2cf2b3d6dc8ea79dc0f54f1daf2623c367768d5f651db7babcebc58f60

SHA512
c60b8ab37bfa9ea21ccf65613a179baa2adc89bd147365981ed9e385293629708aa76fd6371d59f26fb3486a285ef6b605fdbd6c623be926dd72ff746c2a9b30

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt

Filesize
778KB

MD5
104c655fc455c64248df232f0fb69c27

SHA1
b1ff666bb6cfaed876074bf4d074cd11bc481a03

SHA256
6c6232cdd371be87f59f8735b501211aa45ff13bff6109d28172f571db18a5ad

SHA512
d953d2f91c204acec48e857918ff9d387d58693022986e69131edbacbb12c504230f584d474dcea0cc744f0b7a5c822052e1ddf605d836f01f3381ce608a987f

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt (deleted)

Filesize
35KB

MD5
99867b661824225d0f69f12315fd736a

SHA1
471f2fc25d912816c54f3db9c6274402707892eb

SHA256
d0bdab93199d648dd50d993393fb626ff145db1362214cc7f0c0468fbdb9f568

SHA512
1a863357c4f72a1782646da0c1a64bb43bf55355a39410dd09e4562e010bd005abc170cb5411ad79dddb9f936697493033c0ec30c510766cb0d4396a90bfabd1

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/records/com.android.settings_2025-02-05-11-02-06.txt.zip (deleted)

Filesize
27KB

MD5
71b2bcdbc34d03df072547679b0f110e

SHA1
64599569da44cac18f9a455cd4623e6d010ed3ba

SHA256
a57edc5b2981c9d20a3fdaee2695b5a51555a7b887808f2d084a168c5d4be15f

SHA512
1a9cc4e1c490b657ac7aac2b97eacc4829a6dfd8c9d28ddd415fe29458a05b9fb0daa10a9aa5279a7d99bd9099849c4dd7115ece8245733b5762a497a6691573

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads