trickmo | cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0

Resubmissions

05/02/2025, 11:04

250205-m584bavngp 10

05/02/2025, 11:01

250205-m4n2ravnbr 10

05/02/2025, 10:18

250205-mcbmcatmck 10

Analysis

max time kernel
254s
max time network
294s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
05/02/2025, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0.apk
Size

8.1MB
MD5

c889e75eb26de5a53531ca1d799a777e
SHA1

4c9ae2c8bc9a2bc02926ee2a9a49730881907a69
SHA256

cfa37c111d5d86aa348a8411c39fe1c54034c437a5c15777a42638c6a9d03eb0
SHA512

cbe94441f6ea06b1c9c9de0933e9755d3ac7deb3197d795570cde4d0680c87f25c8c3e34c189a8b8d898b8afa9140093dfbf731852cbc6bf02cfc03c00bd5941
SSDEEP

196608:5erveQWOfAMidD+traG/iYVS9MEY2HWv7ecSb5xW:47eQqMidD+hjpVSe/2Uu2

Score

10^/10

trickmo banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://mainworkapp.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/aner.fos540.ex/app_fragile/py.json	4426	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes2.dex	4426	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes3.dex	4426	aner.fos540.ex
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes4.dex	4426	aner.fos540.ex

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	aner.fos540.ex

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	aner.fos540.ex

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	aner.fos540.ex

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	aner.fos540.ex

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	aner.fos540.ex

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	aner.fos540.ex

aner.fos540.ex
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4426

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/aner.fos540.ex/app_fragile/py.json

Filesize
4.9MB

MD5
aae2fff1e66e2ed7098e6a244c9fafc9

SHA1
cb45aa08a26f26d57e4ff2c38c87445baddd88bf

SHA256
1f4ecd2ff4e128f1ff3da8e59d77d3b64eda9ba8514d76abae1f786bbe65420b

SHA512
757310e3bb6855040b4b2a631f221e806721f5666257add6bf834c29b37a19fb953c42d3d04bbeedcd53d1ae1a2337bc61e36db046e46f1de18103e324fefb73

Download Submit
/data/data/aner.fos540.ex/app_fragile/py.json

Filesize
4.9MB

MD5
ad4a8dddb4b956662516a5353912f97c

SHA1
52b4eee991f8eac17572bc57f2b06dba9a6fddce

SHA256
19fd2538eb94df4e5713d9bca304527c08f27a84118ee583fc263cda1ef3b10d

SHA512
37ce05314e1e2a0edbe07f91208265e3c35a63142da54f60732736aa9cb8201dc78025682cb489e0e607826a21df38932ddbaa199fc86d246a91f42a614b2dd4

Download Submit
/data/data/aner.fos540.ex/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/aner.fos540.ex/databases/a

Filesize
20KB

MD5
57baf3e42a94e8dd82e267b2f0619330

SHA1
76512dd29fbaf3cfd2efeae0ac2ab5108b81af19

SHA256
49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c

SHA512
227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
512B

MD5
618456a8e8162c3c611cd4b984452ccf

SHA1
7832a2b092598d39472a4f9b091bce7ac26f657c

SHA256
ef2b92677b04e02ccd8e6701f7fe858a20a4b79c02d267b800ed9c93b11375e7

SHA512
2362f52f9015ae5c2d4b52c70883719522b93cd0ac855b19dfc7be9558f6ca3d013086f9b2f2226b17b32257a0a69d7810f2c60dbcc0b5c483407c2f595e825f

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
8KB

MD5
e1a5e1030daa2b5ddc421d59ffef09d9

SHA1
77abb424b12fe0f3b8d7f93af1ffe97941259c32

SHA256
4931f7117661dd7e88430a4e059ac35a3b5bd88016f71ab71c97f0bebf68550f

SHA512
ea55a122e6564fa894acffd476d613996b4f592f1cf889d2a9ab52a9bc49744b2cb3e7f0b9613c5bf1f411c3981fefc68f1bf1ef558394c7ec755ef6e055e3a8

Download Submit
/data/data/aner.fos540.ex/databases/a-journal

Filesize
8KB

MD5
05151238a83d7982560ee00128268313

SHA1
b40d1945b11772491511732264c8f5cd2072ddb7

SHA256
a0a993f138cf0e2223ab7623c05431ec69ea8ee672601516123cd7cae92ebcfb

SHA512
3eae50843d752c324260c31b0d840fecbad0162083a4b316345e8e4fb8ed3e922f612485c8013b45057827882eab97a8cead198c70ef84264d959203df84a3ec

Download Submit
/data/data/aner.fos540.ex/files/aner.fos540.ex

Filesize
256B

MD5
05b1a744f3cff2a9b4034309a288a84a

SHA1
ecbcb669b62f4a60903332d5b865e0ad820e0694

SHA256
2977a85ba0d7c6f5ae50eb6ddc99de5cf831fcf2d990e8219303d287ea47c99d

SHA512
035f8d48fbc54737b91ed0b2bf9faac5994beaad186572570acf8f1c4f59cc5cf52c325502d4cbc8f13d0305ca63f19f678270b78f794c16d0d039bdde64503c

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8cb67dbfc5aae4d00ee42e535d31c3a4

SHA1
3062b05a3494ba6b34f8387f874c582afeabaae6

SHA256
979566f4b820b1dd828f1492ed2a92cdaabee547f7f4bcfe4debd415c1e15c8a

SHA512
0e5c08984f98fa066999add3fb8729d82dd939d1a320a40e0e6e272febeed662d51772bc5fc505710bbadbc065726f7c06c672ddca5b499f588d396b1b8aba88

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6af2df65fe8171fa33dff09bc983a94b

SHA1
dd9a05ba9570c626adf440e36f4b4f1236741615

SHA256
220cf85a843f9e3b380da5b1596f8e498567e00d9d164488fbbefbcd86107c53

SHA512
79c6097b0434a167f09a8e8e5e3cf79c2b8150c6b09b22e467d3f694e64ed2ca844459f73609f19f5f58b0f5867e90d0537ad3c262af336ad4320ef9daaf4e43

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
62bc25f906a09a9433e36b5a0cc5ca0d

SHA1
37a5165297b6247dcd7d8d79e0e41b26f67d37b5

SHA256
f3dd25b0ec930b8e99c67f077e503eefe61b85be9cab9d1e82782145da40c6e8

SHA512
dd6f1a44c669b0b0a9e2c8bb11aed3b613d60395d83ac0ee7a5fb9ad4819dfdc2bb6e4ab18e8a2c151adccfd31e62cad6301a134b2d0cd33ed396289cdd4ffab

Download Submit
/data/data/aner.fos540.ex/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
a1a606d0ab95e6f7b23c2964111e68f1

SHA1
5bfa10e2e2416d44eac1d688ffe9639e5628500e

SHA256
c74d160a8845bf5850c57ba7c7920f4824ddb3a34041ae8854f6b8ee22772b4d

SHA512
999202164976b60876e0be67838787aeef1e39a3f4ef7fbe327ca4644a07416ea40fbaf5e6d235eac7312184dfbec39ade8ea92a2c660455bdaab61f2e9a004e

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes2.dex

Filesize
308KB

MD5
87fbf4277c7b1354b07ab66e7841e5fc

SHA1
f171167c1e22209bfe6f8e826763fbba7e2dd195

SHA256
d604f9e58075636656da343d9efe1c1af4f225def49e4d288fc8a7442cb07555

SHA512
c74f9f44d6b8d4b3c78b79a2710b66ebf851c6401b8e01926f910e44e4be7ce911286b385558797802eba7ae26b0d0ed06faee79e9e8bbe8ca798f7ce4e4f9fa

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes3.dex

Filesize
264KB

MD5
336b36c9bac9108ef167e46ecd780cf8

SHA1
2f2053b4858cbc16a7fd71634187b829e816e3ec

SHA256
f144ad2da806b72948617d8d35426c21fb682d58c20c5002b3d41eefd80a07b2

SHA512
faaee8913953353783666ec7917e9cbb6774c024369e069de530904a3664cd96ddf7bb0a4b261f7aa8458b33028b39c3af7d66fb62bd3885e7f7fde001c67401

Download Submit
/data/user/0/aner.fos540.ex/app_fragile/py.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/aner.fos540.ex/cache/logs/log.txt

Filesize
83B

MD5
672bd0a9264f9a3bc20bb5a4e3046cdc

SHA1
7d9365d1af70d0acd3d5b4b7b8b9ef600edaee9c

SHA256
6b77637122fb7c3b18ebb3ef2c9a74649777fbf3c41cf77d97bcdcbc467b88b8

SHA512
61bd45d58c9a0d93977588d8ee24ba3c462a105003ae6978ec83efc16ca13a7ab8ac2515e565ae1f746d6091b9139fe8f9eb9a6e5357208f3532510fe616798d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads