trickmo | aba8466f8162846c8adc7be242bb78a346775804de2c14a978d69649b0639c6d

Analysis

max time kernel
128s
max time network
132s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
23/02/2025, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.3MB
MD5

c59b52822aa4d008e2b29372ca143179
SHA1

9adc650d28dd99e8413c3546de9195fa42aefcd5
SHA256

fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
SHA512

f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
SSDEEP

196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json	5064	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex	5064	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex	5064	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex	5064	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5064

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
26d1ec6ee914bb29c3ac1136651085f5

SHA1
74364f16a34795d45343e9b35c15a403103dc247

SHA256
7a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d

SHA512
c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4

Download Submit
/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
993bb17088b5ba8d8a3575ae67ed5a74

SHA1
aea568d297566ae5eba9ab1caf6cc30e4da3bfcd

SHA256
6303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709

SHA512
9ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a

Filesize
20KB

MD5
93e7f88ba7fd4f0152e8e5dc56f1acc0

SHA1
f29883585567a32fe4d487e5df14173c39c09e65

SHA256
dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c

SHA512
be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
52eabcb242b18aeb07d945385d1eaf25

SHA1
16129b48c3183c3c5df6620254a7206c00956ab4

SHA256
358104765301bac4745e17cd7519eeec01aeb6676d3f5325df1e12079f3b46a8

SHA512
782a330886b2fe5a579507a03b501ca0de0f96a4717bda9092f1b1456dca70403d5b96ac6d1acb751b57afc69cabe259087491dad87344455b7fbaa4d900e441

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
8KB

MD5
457216ccff44469c3c7a02bd749c93ea

SHA1
b45ebad3b0a2b53f3922d0fd4bd6ca89108b57fa

SHA256
3b2fc7214666b77e7fee7ec6446c802c332ac148134bd8da136b2709431c53c2

SHA512
94a57d0d2cf137444e2cef663424245e85748357faef5bee9dee23e22f72351123243b3f01da24102affc592fea3d15a23e11e717bd11e5cf5c59f0ffe232d1f

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
8KB

MD5
31124ac16c9d61edefe4ff39ddcd2123

SHA1
e32c17ff41c7cb5fff63e30d23e83d3bf1987c04

SHA256
a57355d8006b6abf4b5359a7abee3ae4c44200a761e83bce00d12535b30cdd3d

SHA512
5252660785b448caca090908c88f24bff5e26e76ee4b144d961ee318ff58485a5d6aab1a1c7f00fb2a609d30a64fe950bc4983865dc77fc2d701b6db396280d8

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
e00bdaafcc435ab228ca455af9b5b192

SHA1
c24a7924383ec3e22ddf10fa3a9aa402c8eb0dfe

SHA256
f53ba625a274abf9b36bd07c5d9d8ff63466ef034fdb254ce427c0235160971f

SHA512
05995e09ef126ca8c3a7dc35e5167d078acdd2350526ace766830726c97bf956fe1916b3ab9e6ac0da36668a0373677b4f24cf5bef9d5f70179ecf6037fc1d2c

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
91537ef4297a60ab7248d121c8d86f58

SHA1
bc5edffd8c5b768fab3bd851dc24a8b4539db773

SHA256
f510fa1f1d5e825a03930b259a7b590ec11218179d9f1d169fda729e5c279712

SHA512
9b7aa38a24591633e63d74c52c5680ff275b10cdb438f237652d6ddfc8a163ccc2cdd2e66d43464420117addb1f681c1fcbaf23aa8c919d9cad871788bd93a6d

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d4af21db0537f6537b0ca68318dd8a36

SHA1
30ceab1ef7d62b0e5d2838770d7bc2f38e4c16db

SHA256
1dd03bcd9008e3ea53cf6c5fd99ebc0664bcf503258dabb9d4fb9ef9098fa299

SHA512
4bda1589c7a1c683576fbd66bc2e8ab108308523060781ece4cafd6f467cec6834e65806bbc64df2998d7c91651f16a1471ff0248dc727015e76dff261d10a37

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
249b319e2cc26278b273f3823ce813ed

SHA1
404bfb22a5db46e91f7dc04bedf92061d149ab80

SHA256
6a7bc60c7445a1e7f057381321256a114de2783000bcce963bfc5767beb04697

SHA512
fba0a10ea05402600bee908810362914037bd14af5d586964afe4e71f7a530d14d4b6c64dc2c5b0e550c0662af2f795ef240b2d3fc621bf8710b8e7e5ff2d9bc

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
d07641194e287dc31bf14db99621dc28

SHA1
db139490b297a2ace844cd6a461f9ed603ed79ac

SHA256
94974e4849a3328bf749f40b2a2a43d15b5e63f4cedcf16f93759928aab24c84

SHA512
cb2378a6e37bb50e827b7338937287e8f6de6b527fdaba364cece1903e341faf31a2dff57e7435a14007e0ad8640535ea41af12a073672190fcca9dfe73bbb62

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
2263e9ce7c7260e0b68f577fcec101df

SHA1
16273583dcdf91b05eb47d083c6b9335211d40a0

SHA256
5205486fec5217bd2cfdfa09e7079940ca04fed429f28508ac7ec14cdcc64066

SHA512
94330611d25a9461cf0161d20b197eee6c58ca2d8e35c21eff8904a95695b62962f6f80d54a55b77afcded7c755f4749770ef621f9ee9be2a261d2d90931f104

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
1001B

MD5
1c56b419f043be564ccf85c040ba4758

SHA1
28c97c81599d098b2034aa18abfc72c6c26ea956

SHA256
e37f82553044557524cb0b7d2de8623384e03ba01d61cf1de79b2335577c00e5

SHA512
ccdc36a1535485c1b62c64ed3ab1f1ae630494e4590506147468bbf0cddd5f5aad538a576a124da28637cd6e138c25ef91433d048ae8422b0d40772d6ae6fd24

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
23KB

MD5
70743342496ba3a942a62ac6f0608422

SHA1
667345693a41aac81ef7a3a8389c0dcfa3eeff6b

SHA256
1d49082ea98d0ce7fb1b464559de733459e97e9222fa56668fef16e2aad7b0a5

SHA512
4164856c05b32596daad1e27abea560c7647a7439baef7ae9d4606fd4ff26f6bcaf12487183b318ffb1f647ca9273ed0e6a8a9436a6cc5c385bb6354e897064b

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
45KB

MD5
5858b447e45628321df0ecb19ff784fa

SHA1
3cea3d625ff9f8bf55d280642a409ced60918edf

SHA256
1158a48b783c886f8ea5b08cc737075b7c8e7344051102a6858ce16c290da485

SHA512
a411b2e96fed208e84bb072cd1f40d6ee9ada00f3d9377f18ad037fbbcf58b955ecb6433a3b135022606285d61559c6dd835cae9f9cb8c35393c7b29a3ed1841

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
67KB

MD5
70c9c02fedca4707c52a42f39ea63494

SHA1
26f67bf3d5ca41c0a8f39cc607a808d86eb03334

SHA256
9d3699ce27c4a20807b0fbf9467b212d5b4d8bc7bb1b9e7a8f603f98034c404e

SHA512
385732645cec2d8b16a0cb8d5a8bbbec80d9ce05ebc278e13868a222b6e8b271c66948be7d211acf3d00c534daca5a33e575676bac39d47d2c08f774e3f554ac

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
89KB

MD5
6cbd36a155149e6607fe29fd1da20049

SHA1
e9996eafa753c47706fb3eebea2049c69e8de5b4

SHA256
769fe9c24bdb92aa9d77f97ba78f6b05b1146e78e9aad56afa49f7bdb98e302d

SHA512
7ac8b2b619fbf60c27a38902170597579032ee24a88db47f48da241f3dfcea3f19e9695e218aded7ec6c513d96597554d3f9c5d224e6a5d49edfe00eacb6dc83

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt

Filesize
178KB

MD5
60b8898cd82d432c2b36343a94dc60c1

SHA1
8fcc76c4f497b9747138a00fe555385c49926f16

SHA256
f1ebed7b2fd791e56427c9b62121594cfae882261af39c50078cd14e0f84079d

SHA512
261e9ff2afe9c9972fb6b07bd196f13334d860f03f18541c19b78afaa3cb8eaf795342b13871452d16206d36d29192866ac469da2e4ad6e33231426300c5f1f2

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-23-23-04-40.txt.zip

Filesize
3KB

MD5
97095dd3005dbeaf7e03f90fe782608c

SHA1
482881361f7298f63fa3a58daf6bd7f82a12bd31

SHA256
b90bca58205d5463749d521829c8fc78045d08ef7d29dde3d7178731b0cb9fb8

SHA512
95fd8882c7e68f4454c9a033e69809df6d8206d91b3beab4cc14579d6d73bad2558097a86ad37e5adc92645b1c903928a1ff257a89ef67f39ef201d00bc457ca

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads