trickmo | aba8466f8162846c8adc7be242bb78a346775804de2c14a978d69649b0639c6d

Resubmissions

25/02/2025, 17:16

250225-vs31jayl16 10

24/02/2025, 03:26

250224-dzkzvszncm 10

Analysis

max time kernel
127s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
24/02/2025, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.3MB
MD5

c59b52822aa4d008e2b29372ca143179
SHA1

9adc650d28dd99e8413c3546de9195fa42aefcd5
SHA256

fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
SHA512

f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
SSDEEP

196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json	4287	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_village/pn.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_village/oat/x86/pn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex	4287	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_village/pn.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_village/oat/x86/pn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex	4287	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_village/pn.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_village/oat/x86/pn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex	4287	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_village/pn.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_village/oat/x86/pn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json	4257	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex	4257	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex	4257	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex	4257	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4257
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_village/pn.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_village/oat/x86/pn.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4287

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
26d1ec6ee914bb29c3ac1136651085f5

SHA1
74364f16a34795d45343e9b35c15a403103dc247

SHA256
7a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d

SHA512
c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4

Download Submit
/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
993bb17088b5ba8d8a3575ae67ed5a74

SHA1
aea568d297566ae5eba9ab1caf6cc30e4da3bfcd

SHA256
6303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709

SHA512
9ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
dcd3850f9a6020ee0027fa9aac81059e

SHA1
6fc152401654738f1ff567938f7a5485eb9e65b9

SHA256
36e1da527cbba4c97fbbacbf7967052cdf2e7cdfde492991ff465bdcaec4fde3

SHA512
cae39c9d889fa83a100b77d456038d0affa76aa5b72ae784f806ab468ec441ecb62427dedd6e2bfa014ecc731586307f859888a15283ac40872dab7c70d1140c

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-wal

Filesize
32KB

MD5
792a04da38b45ab2413308e335026333

SHA1
36980660ec65f88753ee81528473d56b6bec7a99

SHA256
e449be7684bb9e80f9d1bce7a484b7b13717f7e4bc2aabd7895311e2eb20bf06

SHA512
c93705b87a6b75f0a77e19aa548a632d479306b47ffb6d7b4ff9fa5f192e0b718122fb17754285b0362e7ff70d23aac3bb20266aed6af3ad143b429ece5fd01a

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
f42752e5748dca55a7652af318daefb3

SHA1
41e42ea1784707a54478ac5295d85507b084816f

SHA256
aa18fbdb0e4f0b3a2f0e3c85440de462b810083dce5fee505b0e3e7edd2eb6ae

SHA512
90d48b1a6171c921357053b6200e1dfaa89ac06a1d6db897463c05843b7234cca0cd7a312f91b5ae27b848f6ebeb8d5b742758a5d049542d6bcac1db3a3c7f10

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
190f601d2275265aca044d829be3222e

SHA1
3d4e6e0b5775e091ab2eacd1f969c3a3ddc21016

SHA256
bf7bf2c551a9c71c7a94a504e4f85c44de03a34e0242234209eda97d884a484b

SHA512
ab83e27af86301bc31294d71e89dd85d4be7ba9468b55a84aa18934af087bcc763e1c329203f51b7da83532b215d72f37c20fc9e0222be6b8b6f40dfd2760859

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
7bb1a1f47414bd4531fb9726ecd818de

SHA1
8bfaa9eb1b559d3a54029c66c7daef0f37e4a07e

SHA256
fd641f35cd6613c4d39beca310c3d4341a9ee92e5ee761cdbbd2a2c17e4e83bd

SHA512
06ff2584c3002fb3497e8e3e3e27c81e79d91ed681cd81704292c9f0570378e88319e505e7358eccf4202d7e91b094305054a60c76fbe5e7f4f93bfe4a341e1f

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
818825cfa9e1a12791e21a13c238308e

SHA1
97755f0b6953c81a5eeb6115ccc3adc4d665f4a3

SHA256
b12b8fff82afbbed63a373586c81214ccad96ff793de8ab3b667e00abbac8bb9

SHA512
27f6695962f5b4865d4ec8eef5df4d47fe797da5bbf10cd740aa58a1f8f49f4ce32e96fa29319388f151dd0dfa70232fdff2404ea98891402189ce777a13ca5e

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
7fb02a39158d5ce6762b85443b82708b

SHA1
0ba6f00bf6c7b74b2d7cb305d46e440d5ee71516

SHA256
e99e3c480651f085efef91ee576c8c4515b90066c83249d182b8a4f4ef9a0d43

SHA512
a0ecf139fe705022e3f03f5194c28cbbd8a74ccd33cf78031fbbb4bbe1059df4358611211a05580ccc51c6f7faafe24b46536bde284c8f7bd658ea4289a80ba7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
97b7f0008accfec2f47ecd7da8d5d77e

SHA1
a5662fbb28c2f3e19383096f50e93e35ad64a858

SHA256
e6d7b5400e83a8f63021b4d99fdf63639daaf132aae8ca8d5a40a3471604c8cd

SHA512
ba5261481059567fe422da296484420e2b6a7ef59b9de963a091c06b0181100162d2bcd284af742ec3ff886a56f4972a24003ce48562510893d36fbee87c9800

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads