Analysis
-
max time kernel
128s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
24/02/2025, 03:26
General
-
Target
deper.apk
-
Size
7.3MB
-
MD5
c59b52822aa4d008e2b29372ca143179
-
SHA1
9adc650d28dd99e8413c3546de9195fa42aefcd5
-
SHA256
fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
-
SHA512
f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
-
SSDEEP
196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD526d1ec6ee914bb29c3ac1136651085f5
SHA174364f16a34795d45343e9b35c15a403103dc247
SHA2567a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d
SHA512c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4
-
Filesize
4.9MB
MD5993bb17088b5ba8d8a3575ae67ed5a74
SHA1aea568d297566ae5eba9ab1caf6cc30e4da3bfcd
SHA2566303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709
SHA5129ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD5089881b2ff13045e5b1c8715739388d9
SHA172e2aaaefb1908ba906bdf7751b6b182d8b25280
SHA256daaaf7089f7ede9480e32e176d9956ba7b441a406588a68759944e0b5d4f2463
SHA5123f33c2625e98316f60b34165d56c60e24ff16f6aec303008d039c7cecc911eb9baf76525512f757ab043c566147cbd2cca4fecb340984eeddb6d326d4555beb8
-
Filesize
16KB
MD5d8412444e56b6a0b8eff8e0acd345e9a
SHA1b4ef0924acbcd490be41ae9dd315708e437baab6
SHA2565eb56cb2b9a053735f05bccb4a18bc073204f4f157b4ceb7fc8e3a3be32adab7
SHA512bb9883de9838b3a9d94207b856f486fe54bb68a578deada755d29be9c2d691c3fc241e4c8179cded8611eb07016619a7a50ecf12d992217cf56410238a0b7588
-
Filesize
512B
MD59afd612146576bbf2abba5a369ea197b
SHA1620affbd12fbce78134d109da5849d8148745240
SHA256f12c17f78788530d019c04589e25035dd28c2897b2754f0e35cf79fe7c47890e
SHA512003dfebffb6f4f483fd43336b425ee364494e76c01c3f52e6872069d52e71424631bd50c9b704193fdd1c1432cabd9a191fa6c5891197dec9a761102427b3562
-
Filesize
8KB
MD5b723b4e03c54482593fd58b22d7ec9d0
SHA19644e8e2bd636581c9d4cfda372e80623f05d431
SHA2563b09c7b04b68286d3bfea296b8aa05587726d79e3cdad0cbc803c520dd15f1c9
SHA51222fdff5835c7d35649a2560303cae727779397406418f717ecaf28a8a289a7ad43bc260ed7dcafa797ad57429e85ddfdf3a3a194dee1566cec8574f9e5715d42
-
Filesize
8KB
MD5dc905ea62a19c371f6bbc382dac0ddcd
SHA13d488f930eb46f818f4cfe5a005f05fa3ed7884e
SHA256df052260332a34db67de6f63fc8d39929b3fea0d09988973e26542ab07b75a4f
SHA5126f37bd3fbf74a62b2efbddb2072a1d95887bdc9921da038ccf808137214a800a1aadeaf0fcc026b0d10176375f2060530aadee7c0558ba55b366ee61fc750e0f
-
Filesize
12KB
MD5ee29b885fdc42e4e753277b3c9a638e9
SHA1ddb071006e3faa0bd77e833d341f4c4f9435bf90
SHA256bdde6691f81e29bd85af8ddb39ee81878927b96ad0c58bcdab70cb4fd19f3b02
SHA512040c9f26ea11ad4b29ebd57540a4884e1fa640295bcd52f92d9ce44a10ed8af70957ce9b5545d55cdf3fb9160b93101d1b962bf809f553624d1875b29c855045
-
Filesize
8KB
MD5a377ed33e7d8f1106edc794ad08e52dd
SHA142134d07e0b75813ed3aa21ff0297d25daa75a25
SHA25683e20ad6183aa75400b24ba88d526bc2dc479891edd85827dc605702782b063d
SHA512aef10df3108ef663d8ec64317664f95dac0692242e914a1c0785fd292bf8bc11ae63a504036d5e103e1c8ecfc5e3f15d939155832a5fcd13f3e7d9b35632d00b
-
Filesize
256B
MD55a9e531f56b36945ea01e07afb20fa88
SHA183b13215dc43cead3ea9cceab4870cc66b7a572b
SHA2566d169893e43825ba2dd2fea68ddf19fa68dddde9388af5e296e2319be8b2ec67
SHA5120c439a8434ba2805b8247420b9a975383a4b1003416d8248d2d3d4a7bd3f8cac9eb898a8186fc4f65130860188a4638fe663aac671d75b91b54299a0a0a1ef33
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5ea98f90df7f0e328942381a343f42f85
SHA183440cf97ce01818daf5789480120389c5d17d9f
SHA2563a2fdfad37f6d1f64e13ff47dedb27cdaf0e9ce0de31873269361cb9f9f24e5a
SHA512129188092e696c532b49ba0576527913ee4e20d8dcae17e575c2685364b401ea0a02286ba859abd035ca9e2b08cadb9b8ff59521b0ef12f747a3512fec32b55e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5fc9f149fb41b1396f01d46536ccf9e4f
SHA1d83fb454749ddf86efc4cd53634314cc3a912fb2
SHA256242332db873e74eb257d61fb3e484ccc3501e38e9c246e9fda283848c8baf5f9
SHA512cc611590afff2733c73fa0678b71a4042588cf480a4211933bbffe00d670a5890a00a7e2cf35cbb29ab948b004fdc6b2b091859fb26edfdd8737866dea4d4448
-
Filesize
16KB
MD571c727f6464fcbb5e5e233dd4aca701e
SHA11e0bba2f41dea22b9ee827f88112ee142e502e3c
SHA25632b7c7b0d883f0d5de6407214b0d72a7e1cbdf8373918df532c0651e4a41663e
SHA512ad790ad8645f1b13fa3ef659cc85b042e1c5dbcd83104f2a7ffba31dff46a77f9c9f76847b1e38aa93088ede3c5b395872138ab74737af01bf08d0fdc002ee03
-
Filesize
108KB
MD5ee6bd6cb09a9e573814f02197a19bc37
SHA1417d8ffd2523d658b6c927925b33a73ec86f743a
SHA2565337d85fe28b79ae851be0d15eeb669b2008c9ff18c4c32d4c063a86c34aeb8d
SHA512cb456adb37626da153c352faf2d180175e02c5e48c89565b949e50d9b03e74bede9d0078770fd2ab10af2e85cb69fc947fd5155b4fc955c39ed23b1cd006867c
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5f7ebd6d383f013836b840443a00a8fa3
SHA1569880cae4a818f0afc9bf483c40d3b145f21b35
SHA256c179ebdd0f05f0abd65caea10d1f362599ddee50a2914e2369178caf3b3295a5
SHA512fc789c20752694ca23d9b234a6f7fba8968fa154455ceeb63e2af1ec95ee47640054421f07e85edaef20655b6cad52a69691711e2e8375c07fed3b457d516704