Overview

overview

10

Static

static

6

cfa37c111d...b0.apk

android-9-x86

10

cfa37c111d...b0.apk

android-10-x64

10

cfa37c111d...b0.apk

android-11-x64

10

Resubmissions

05/02/2025, 11:04 UTC

250205-m584bavngp 10

05/02/2025, 11:01 UTC

250205-m4n2ravnbr 10

05/02/2025, 10:18 UTC

250205-mcbmcatmck 10

Analysis

  • max time kernel
    161s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05/02/2025, 11:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0.apk

  • Size

    8.1MB

  • MD5

    c889e75eb26de5a53531ca1d799a777e

  • SHA1

    4c9ae2c8bc9a2bc02926ee2a9a49730881907a69

  • SHA256

    cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0

  • SHA512

    cbe94441f6ea06b1c9c9de0933e9755d3ac7deb3197d795570cde4d0680c87f25c8c3e34c189a8b8d898b8afa9140093dfbf731852cbc6bf02cfc03c00bd5941

  • SSDEEP

    196608:5erveQWOfAMidD+traG/iYVS9MEY2HWv7ecSb5xW:47eQqMidD+hjpVSe/2Uu2

Score
10/10
trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

Malware Config

Extracted

Family

trickmo

C2

http://mainworkapp.com/c

Signatures

  • TrickMo

    TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.

    trojaninfostealerbankertrickmo
  • Trickmo family
    trickmo
  • Loads dropped Dex/Jar 1 TTPs 8 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • aner.fos540.ex
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4213
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/aner.fos540.ex/app_fragile/py.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/aner.fos540.ex/app_fragile/oat/x86/py.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4273

Network

  • flag-au
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
  • flag-au
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
  • flag-au
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.179.238
  • flag-au
    DNS
    xxxtik.com
    Remote address:
    1.1.1.1:53
    Request
    xxxtik.com
    IN A
    Response
    xxxtik.com
    IN A
    164.92.225.151
  • flag-au
    DNS
    appassets.androidplatform.net
    Remote address:
    1.1.1.1:53
    Request
    appassets.androidplatform.net
    IN A
    Response
  • flag-au
    DNS
    a.pemsrv.com
    Remote address:
    1.1.1.1:53
    Request
    a.pemsrv.com
    IN A
    Response
    a.pemsrv.com
    IN CNAME
    1108595013.rsc.cdn77.org
    1108595013.rsc.cdn77.org
    IN A
    89.187.167.41
    1108595013.rsc.cdn77.org
    IN A
    84.17.50.8
    1108595013.rsc.cdn77.org
    IN A
    89.187.167.39
  • flag-au
    DNS
    turbulent-divide.com
    Remote address:
    1.1.1.1:53
    Request
    turbulent-divide.com
    IN A
    Response
    turbulent-divide.com
    IN A
    188.72.219.35
  • flag-au
    DNS
    s.pemsrv.com
    Remote address:
    1.1.1.1:53
    Request
    s.pemsrv.com
    IN A
    Response
    s.pemsrv.com
    IN CNAME
    tk6if76q.ab1n.net
    tk6if76q.ab1n.net
    IN A
    95.211.229.248
    tk6if76q.ab1n.net
    IN A
    95.211.229.247
  • flag-au
    DNS
    s3t3d2y8.afcdn.net
    Remote address:
    1.1.1.1:53
    Request
    s3t3d2y8.afcdn.net
    IN A
    Response
    s3t3d2y8.afcdn.net
    IN CNAME
    1208818836.rsc.cdn77.org
    1208818836.rsc.cdn77.org
    IN A
    84.17.50.9
    1208818836.rsc.cdn77.org
    IN A
    89.187.167.41
    1208818836.rsc.cdn77.org
    IN A
    89.187.167.38
  • flag-au
    DNS
    www.google.com
    Remote address:
    1.1.1.1:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    142.250.200.36
  • 142.250.200.10:443
    tls, https
    202 B
     40 B
     1
    1
  • 142.250.200.46:443
    tls, https
    858 B
     40 B
     1
    1
  • 142.250.179.238:443
    android.apis.google.com
    tls
    4.7kB
     8.5kB
     14
    23
  • 164.92.225.151:443
    xxxtik.com
    tls
    2.3kB
     13.2kB
     25
    20
  • 164.92.225.151:443
    xxxtik.com
    tls
    11.8kB
     407.0kB
     187
    276
  • 89.187.167.41:443
    a.pemsrv.com
    tls
    2.3kB
     52.5kB
     29
    48
  • 188.72.219.35:443
    turbulent-divide.com
    tls
    1.3kB
     3.8kB
     12
    11
  • 95.211.229.248:443
    s.pemsrv.com
    tls
    1.8kB
     5.5kB
     11
    10
  • 84.17.50.9:443
    s3t3d2y8.afcdn.net
    tls
    2.5kB
     47.3kB
     30
    44
  • 84.17.50.9:443
    s3t3d2y8.afcdn.net
    tls
    622 B
     3.3kB
     6
    7
  • 142.250.200.36:443
    www.google.com
    tls
    2.0kB
     10.4kB
     17
    22
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    160 B
     288 B
     2
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    172.217.169.10
    142.250.179.234
    216.58.204.74
    142.250.187.202
    142.250.180.10
    172.217.169.74
    142.250.200.10
    216.58.212.202
    142.250.178.10
    142.250.200.42
    216.58.201.106
    142.250.187.234
    172.217.16.234

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.179.238

  • 1.1.1.1:53
    xxxtik.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    xxxtik.com

    DNS Response

    164.92.225.151

  • 1.1.1.1:53
    appassets.androidplatform.net
    dns
    75 B
     135 B
     1
    1

    DNS Request

    appassets.androidplatform.net

  • 1.1.1.1:53
    a.pemsrv.com
    dns
    58 B
     144 B
     1
    1

    DNS Request

    a.pemsrv.com

    DNS Response

    89.187.167.41
    84.17.50.8
    89.187.167.39

  • 1.1.1.1:53
    turbulent-divide.com
    dns
    66 B
     82 B
     1
    1

    DNS Request

    turbulent-divide.com

    DNS Response

    188.72.219.35

  • 1.1.1.1:53
    s.pemsrv.com
    dns
    58 B
     121 B
     1
    1

    DNS Request

    s.pemsrv.com

    DNS Response

    95.211.229.248
    95.211.229.247

  • 1.1.1.1:53
    s3t3d2y8.afcdn.net
    dns
    64 B
     150 B
     1
    1

    DNS Request

    s3t3d2y8.afcdn.net

    DNS Response

    84.17.50.9
    89.187.167.41
    89.187.167.38

  • 1.1.1.1:53
    www.google.com
    dns
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    142.250.200.36

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/aner.fos540.ex/app_fragile/py.json
    Filesize

    4.9MB

    MD5

    aae2fff1e66e2ed7098e6a244c9fafc9

    SHA1

    cb45aa08a26f26d57e4ff2c38c87445baddd88bf

    SHA256

    1f4ecd2ff4e128f1ff3da8e59d77d3b64eda9ba8514d76abae1f786bbe65420b

    SHA512

    757310e3bb6855040b4b2a631f221e806721f5666257add6bf834c29b37a19fb953c42d3d04bbeedcd53d1ae1a2337bc61e36db046e46f1de18103e324fefb73

    Download Submit

  • /data/data/aner.fos540.ex/app_fragile/py.json
    Filesize

    4.9MB

    MD5

    ad4a8dddb4b956662516a5353912f97c

    SHA1

    52b4eee991f8eac17572bc57f2b06dba9a6fddce

    SHA256

    19fd2538eb94df4e5713d9bca304527c08f27a84118ee583fc263cda1ef3b10d

    SHA512

    37ce05314e1e2a0edbe07f91208265e3c35a63142da54f60732736aa9cb8201dc78025682cb489e0e607826a21df38932ddbaa199fc86d246a91f42a614b2dd4

    Download Submit

  • /data/data/aner.fos540.ex/cache/clicker.json
    Filesize

    17KB

    MD5

    d780f836fe54e51872bf31220a4dcb77

    SHA1

    5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

    SHA256

    32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

    SHA512

    62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

    Download Submit

  • /data/data/aner.fos540.ex/databases/a-journal
    Filesize

    512B

    MD5

    80b3f16cce4c9303d2377b025f87f3a1

    SHA1

    73fb52ca692f6d73160a3e9afb4cd855b1f49ab4

    SHA256

    07f5b3a21915990bb3af3eaf6b77052f996734b3423f1dbf1ede8fa8d89b6964

    SHA512

    ea56ead98fcbe2b3939654c63f3f05cab6361d5388b0b4709d08821e56156f3ede78dd3c95b1c1916abc1e37ef65a19e5cee32d11be8cb6a9b28fbf6026248c1

    Download Submit

  • /data/data/aner.fos540.ex/databases/a-wal
    Filesize

    32KB

    MD5

    6522570b5a55d606eddca0e2244c9e05

    SHA1

    41c35aa8bf4cfd793cc2c9dda054c77313b89b0c

    SHA256

    0b1b4e1a51c81202641b8fea806b86c2657c568a3efbd5c47e78cd29791887eb

    SHA512

    daf98f4a5bc22ca260628d2c91a3b502a89624af52958384d74cfa69bb0e70f5a00733e0b2a456d28c59f25effa1bdb1bab48a879a73417f0ad66ff1b5baaf1f

    Download Submit

  • /data/data/aner.fos540.ex/files/aner.fos540.ex
    Filesize

    256B

    MD5

    a5b600bd8864a118a4816c55f9d99b59

    SHA1

    5a529872e561ee199527284bf578e2fc79fd8de4

    SHA256

    c5b6f2e2dd79e6cd6394771bd57b0cbd8adc07f704997352a9f009e151047621

    SHA512

    e848a199c7034adf49319b4f6a7c4c0bc8ff6b992b03b02f2e40ff9cd63fa6b725843b4c0201ce0e23d26f78387da15791092f35ca2cde45a2090829107bf8c1

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    ee2b2798f445bcbe32ef214814a8338b

    SHA1

    11f60536ad297cad39abf0c495d353c76f8733e0

    SHA256

    f3d8a0005c1ff1e35c835daab6f9bb6e12f94a21d4a3aea8e44112cd66aa6b2a

    SHA512

    521adfe5f2350caac87caa72709ff65e11b1991d860e06d877664d43dfaedaf4e146073cd38811e4c53b81fd8756d1de8b605a37fa35d11453370fcf28b132ac

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    9afd725202547aa776ba1ce03376e53f

    SHA1

    1484dfe9dc8c813e985d31f0f7086c1b94136a24

    SHA256

    21788ae56b70dc0e56c9a02c9627f7223ac59f637bc73cbe3d36c0c6ee7e6bed

    SHA512

    6b8676d9660033101471bbee9552bd2ccb99c4c666b19cb9ddb90ae750684dc8b092f1a6259a5fa13b73d9157860c9bc3f34a36e12eaae4e71fdd7f5485ec40c

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    dabc97d854e414896be43e475061f44b

    SHA1

    86df3124e7eff97739fbf95d8b3be3625a8031be

    SHA256

    210f43a4dc2f5ac19842a8884d2e9c3b12374dc853a25791d5cc4d2bdbd2bfb7

    SHA512

    46c7e853ff760b27abd47831324b9cba2a32b98fd80076e03085a288a2242c9c8a7bc176512d5a7356019323f3255908e5cf74a728c158c883882d8ce7f8fbc7

    Download Submit

  • /data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    bbcc55be26d51339a0e95b06a7a68f60

    SHA1

    e24b36bda60dc160e81576a19d73309a7c17748d

    SHA256

    993c963ae970bffeb91b26081c2188524d1425d8310bd42fad2493b9ecdfc036

    SHA512

    bb621cb7eb8cd660b370b9ed676380c14e59bbd817a713dc8129b54db1fbe1bf6dab640bf6f3019a24167df92479c8feff3f5617d9b7432bdb8a8fec975782ee

    Download Submit

  • /data/user/0/aner.fos540.ex/app_fragile/py.json
    Filesize

    10.9MB

    MD5

    35d4cda95e19e9be467673c78e1e2fa2

    SHA1

    3868d4dda794c360f57ba650c332b39ce5c68d8e

    SHA256

    6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

    SHA512

    577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

    Download Submit

  • /data/user/0/aner.fos540.ex/app_fragile/py.json!classes2.dex
    Filesize

    308KB

    MD5

    87fbf4277c7b1354b07ab66e7841e5fc

    SHA1

    f171167c1e22209bfe6f8e826763fbba7e2dd195

    SHA256

    d604f9e58075636656da343d9efe1c1af4f225def49e4d288fc8a7442cb07555

    SHA512

    c74f9f44d6b8d4b3c78b79a2710b66ebf851c6401b8e01926f910e44e4be7ce911286b385558797802eba7ae26b0d0ed06faee79e9e8bbe8ca798f7ce4e4f9fa

    Download Submit

  • /data/user/0/aner.fos540.ex/app_fragile/py.json!classes3.dex
    Filesize

    264KB

    MD5

    336b36c9bac9108ef167e46ecd780cf8

    SHA1

    2f2053b4858cbc16a7fd71634187b829e816e3ec

    SHA256

    f144ad2da806b72948617d8d35426c21fb682d58c20c5002b3d41eefd80a07b2

    SHA512

    faaee8913953353783666ec7917e9cbb6774c024369e069de530904a3664cd96ddf7bb0a4b261f7aa8458b33028b39c3af7d66fb62bd3885e7f7fde001c67401

    Download Submit

  • /data/user/0/aner.fos540.ex/app_fragile/py.json!classes4.dex
    Filesize

    1.7MB

    MD5

    30465152db261852e3a226a666ec4304

    SHA1

    442a188e07db85653022734d0a8537d4312aef38

    SHA256

    c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

    SHA512

    3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

    Download Submit

  • /storage/emulated/0/Android/data/aner.fos540.ex/cache/logs/log.txt
    Filesize

    83B

    MD5

    d747e4b8726c22777f13e06b09c396b2

    SHA1

    68c4b75e0d0fcb1da5f17c79d4afedbff2b108fb

    SHA256

    40d90fed937527486d9d67666e0ad2d5da7584ec8a434773b7605c751cf2abb4

    SHA512

    77c79d3f3bc82ba385c74edb6ec8e9186b2b5deed384ecd83088600923c08cdb52f04dd4f4b7506ba6afe921e1775338c5c3ead8f8eae91e07b2b6d5c7017b9d

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.