Resubmissions
18/02/2025, 20:08
250218-ywn8bsxrc1 1024/01/2025, 04:44
250124-fcwh7azqas 1024/01/2025, 04:37
250124-e8zp2sznay 10Analysis
-
max time kernel
134s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
18/02/2025, 20:08
General
-
Target
deper.apk
-
Size
6.8MB
-
MD5
2d34dbb4167ebb371e33f3ce700fdbc8
-
SHA1
4a20849866f90262f9a0b2793f84cc7d5e057656
-
SHA256
c00419b21d10a236b47b43bb1eed3dbc5298e471cf9616848a84da5baae8e611
-
SHA512
20365af814427670ea62987e750657a04d03c509382abe655f87952d6794981e7811c0b7aa9dede998263c2e2a98c5c008848324c4e653eba77517fc6c7c034b
-
SSDEEP
196608:Lh1ZR29n2MKoRk+bB5fKnQgO5SS4xx3Dajo:9BgnzRL5fKnQgkSl3Dajo
Malware Config
Extracted
trickmo
http://traktortany.org/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
lansa.sis722.sers1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59f765bbbb28171e35f6f17ee95ebdb90
SHA17bfb941907bea2a41e20f38e31c07566d8d3f7ef
SHA256c552d3c465661b4bf87bac3eeb7a9000569a5b19cdc05094713076b89a776c83
SHA512144b72da338daa9b520d181934fc63f65165e8415085efeb1fbe32aee33ac1b35305d7040829c725300ce54342ddc62bbb601bfa2ad383da3b4007bb8760c4c5
-
Filesize
4.9MB
MD5cd652200aa24e4da945fcca01cf402ce
SHA1ec15238d8fa5f5906b1725965bb5eaef3f977172
SHA2566296249f78b601b6d29c26e49f59a99ba4074358d82e4229d1b0eb137bd03408
SHA5127d4aa9255ba25ffe1b07cefdc0ca05daa13c12d22974c050b17ef83f07f49eebe62fd125e3f9ef96524c345e4882d6eade3220a4b2243ebeddfe63a5366aad9d
-
Filesize
20KB
MD5e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA2566e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
SHA512443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD515f1907d953c11f1456bd58ffab5152e
SHA1f51865ea7b2b8d2b45a41f5efbe9160abdc594d5
SHA25693b31032b0b4f3bfedf615ababc19a2719423b4cfcffbe24fe767cd530ebd91d
SHA51251b89e7cc1f271bc89cf18c9029b1263d51b7d5e468cc1764c7d9a9c8907c17cc2470f7a6e2a2462e24aba482de64dd9d18c20a232953dce4d6a5cc558aeb2f5
-
Filesize
8KB
MD54ec2722f07c1ca5878f82c718e06374c
SHA157b552864e5462c3d903046896945c943f5bfc44
SHA25650137b8d0dafcf89e321439888604b699215d3a879fe91fd8436889a9b7c07e0
SHA5121c1c1298ef41432a4c82e6b4ddde73e1596beb3e53d263cd022a59e3567a6492d7e2f1b65abd3a097738f12a2814954194f93ca956520812f908df0acac5d277
-
Filesize
8KB
MD5fd704836f6faf7f0f45f85979924ac08
SHA1767d8aedd04bd2258e6872ed79b7a384bc93afa8
SHA25647a63d769682c5c8915059b81b5fd7bcbcdebf420fc02ec6a4cf1a26e7890f7d
SHA512fb0862dd4f29ef90bc426a235d185b50c6f81c1cd6f1d76ba493b3d1a81184f8d2c3c3462917edf15fe720688337d3fddb2ae09de7df91023cfac4cefd050927
-
Filesize
256B
MD580ffef2d8d657b2fd894b3aba1d3abbd
SHA1ffa8d0644d2b19e1ff38fd7f008f20595c35f229
SHA256681c98073a4154c51ee24a69f4b71e4f1baad02166b4fdeba7d27e5478cf7d7d
SHA512d63e8a19c498b1cbaa86c09e711a1e8863c4eab158c7856fdc5de80bf2d5c417f14ec528f1cdcb7c33dc765e716559aaa93eeca32d1e5157141025a928a0cfcd
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD55bdba046597265df72aa87bfc8c809cd
SHA1a7070e24af808fd4ddaaaf65df2d5658cb39b381
SHA256d92ab09dc19095fddb95e0fe3aea2211b88f8e3f04528834550cf829ee7d638a
SHA5123fc05e47dc525fa92f01e03aecbe03ab99120b9c7c3bc679d1909fa71e6112e7885316c9cf7bb8683474b144447fcdd58ac10b13a7b7f49080257b06294906fc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5297939207567086cf6f29aad1ca0d9eb
SHA14a67b472d7529c1cc2f8ac318ff02ab4417a13eb
SHA25618286f97ea9223adbac5aa9d9c8009a9ac95679d2a56216c3681abc46a0fca16
SHA5123ad55369dda697b21bea3053c43b965bd54702f704d0888781db6a846f3d835a44ac16cd6e33f9d4ed70b0a10c7a7a2e72129beee860221cc2f194fa4dfce4d7
-
Filesize
16KB
MD5b257565b37cddf62f63a6e756f6f3a33
SHA184a65b5320dd2b93fe075c3c50fac0582e410ea1
SHA2560d09a14fd1104ec04d06433d9656be78833ee6a14f0f5229c3c2d9612e8ff067
SHA51289c6acd086bacda212907d6b9ce2e03cd3d299ad7d49262fc8f3ff2a8aff2042d789bfc50e68761acd020a26f8b74a9d4afb68c61963faf0cc42152f20beb0ad
-
Filesize
108KB
MD5a0ae3f9f093637f2f4675ea43616ceb0
SHA1867fcb02c562b5369670e8c3490a409ab78f2e96
SHA2564f1b743a5f1659da9d4cfb8ae27b9c63a71963f0af006892fa9c7da7ebd2d306
SHA512e551cfc7bce68806e4dfb8b0ba27f4e7a495c3872f7a0ddb3dc64a708b478524c3757fbbe1df40e42e336feba4ebeb3372b4f9acd60319e5714f04fc616f85fa
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD55e58845043089ee3b37392fec0f23992
SHA15e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA256ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
SHA51284387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
-
Filesize
265KB
MD5cc92d248d0c568e5351842d103bce7a9
SHA11d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA2560201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
SHA512a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD515814740ed2a09c02404484a7ad9859b
SHA1c2696facdd354101133982c922ea9b35bcdb0386
SHA25619b9e6905ee6ef597403878defc24f4d673e14e4e17af018404e0b302e995a40
SHA512b6443d0435ef6c5e216d6dcddd4d4d210dee51fb7580d947695c4ec63fd2b1e8f57eeeb61fee79e2ba22468c591b8059d2171a636845f9327afb05924bb712d4