Analysis
-
max time kernel
126s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
23/02/2025, 23:07
General
-
Target
deper.apk
-
Size
7.3MB
-
MD5
c59b52822aa4d008e2b29372ca143179
-
SHA1
9adc650d28dd99e8413c3546de9195fa42aefcd5
-
SHA256
fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
-
SHA512
f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
-
SSDEEP
196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD526d1ec6ee914bb29c3ac1136651085f5
SHA174364f16a34795d45343e9b35c15a403103dc247
SHA2567a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d
SHA512c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4
-
Filesize
4.9MB
MD5993bb17088b5ba8d8a3575ae67ed5a74
SHA1aea568d297566ae5eba9ab1caf6cc30e4da3bfcd
SHA2566303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709
SHA5129ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD5d82fd1cbea668845fd775456bdb2d27e
SHA1f3254178ab65e35fd7c427797cad53d75cab3bc3
SHA256c0ccf08597a666f105035810fe98a1901f2596c16c3b3cbdeab09a36f653c025
SHA512e3eb63a2dfd5571c110468ef4e17f05e627b779886c26c48d6045060579507317b5c6f2e9ec7d08ff439094dd90e478d71b749183420ab6e831d8749d852ccb9
-
Filesize
8KB
MD5d61601da36e77b76d2cdb4807b1ae44e
SHA118d58b5366201af076108622f7c75c2754d86837
SHA256e9c1161fbf5a8df7a38ef4640f0aadb6b55dab170b08b60fe86b235a02552030
SHA512a0f3fd8e14476edc8beb54f266b6e25accf08f9b936f20640efacbfbca43c1c4876e221f5781b0fa0e62fc1d8d15a08fe7e5b685e876656b4e187a11f163a0b5
-
Filesize
8KB
MD5402f0b695c6ca88a7723298f67e0f1d3
SHA152e55dd97c5988648912783f17f9679ec3236b09
SHA256910ac7c58a5a749af330a72a64a6cc3dd11e405bae6f6274b14a48579bba5dc9
SHA512c42710095149e56729b82f15048413891b961661b46ac12cc3acbb818067a4310343bdcc2ff0012a0d6aa68f20d8d94fd44bc5b68b8c51daec974e78ce0dd08f
-
Filesize
256B
MD5cadb0e40952eb89db2e7430bb3fbac08
SHA1581f47fd6e36b8b8d93d5d5fa512363dc2d352c4
SHA256c9c91146c727f649817867bfa6b9cc244c96736a7dfe1ec489704f718c3c8984
SHA512f8f0a1e4445d17bdd3ad4744bc616d963d0721492ce20bc1e08086b7b18e7969b78d4f3682df71a24ef78a52f0bc18a3d70a4d12441aac98572e3a42be21fc44
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5df234831f2d3f9cc9a1a4c94cb4bc9b8
SHA1c6ef6c42a3c7c1e483e82758861a4d726ffd196b
SHA256075cbea33637210efac1e16f7f7bea7d2fac07e5caff0895a151a2011803cd75
SHA512e13df1549eb6a8f17d25215c7117c716c3b38b561b92e223c3c81aa567d0ce4a17b57ce1aa5198b2933ba0c7cc2a272f9ea116ef569d98de6830952398ab2252
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5bf7bd2a68fd70803a40cf48304f362cc
SHA1ada4febf3381e638fa99f2f9466481afd0cdbf03
SHA25641d09c4df5137a124c18d68dfb3ed91b2133213eb14a276726eedafe5c7d8244
SHA512cf9863d6386941fde712a79d798237b0cf4768cf93b40090a1a660de5e379ec0373f53c4ab719d727b1b18351d809541d290a0e2ff43e8473d0cf60f50473459
-
Filesize
16KB
MD56635cb7deb3294f62579fe5a4e8e9769
SHA1f8999dde1509eddfcac1181078ffca86bccd3252
SHA2567a728ca7e6babb6b0fd851d3e0ed3aaa4c196607117208989c66eac8484b4801
SHA51294afb6d7b24a2da3b412b3591f0536e26f49e32130637b7c3fc98892196bf6ae43262afe3efde724f957800d5028c2537dd5207df69614e8619781298e066eff
-
Filesize
108KB
MD5f8852f641ba9383636ed1d2c0eba4bc0
SHA1140a8e83576af8c14accafe1ce3ccc2ab4b5953e
SHA256fcd8c2c42d38a655084ffcb43b5ddcd1a2aefb55271ceccbdbf3421f65a7090b
SHA512248752e263a59d6774e69ca7b1cfb2ca09138fc9c28d46324153831abd6771acf6ff358f14d6e880338002e9014f94f9116400b64dc7d1aaff0a1334a72b8c12
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5cee17f24cc43ab631b4e93fdd2e65127
SHA1af16a38ed15216ee5a496670d69409d9db6ebbf1
SHA256c1efacae1bbc80d0f0932b9bf31479672fd633b29db49f14b6dcaf61817a2fb4
SHA512afc62f608348cee6620b9b88198ecdee33cbcaae112ef144481875fda6890810b73bc8a2d4add08c0120364182ef6b0b7c421448dbf78bc9d5a4021752999cb4