Analysis
-
max time kernel
126s -
max time network
160s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24/02/2025, 03:26
General
-
Target
deper.apk
-
Size
7.3MB
-
MD5
c59b52822aa4d008e2b29372ca143179
-
SHA1
9adc650d28dd99e8413c3546de9195fa42aefcd5
-
SHA256
fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
-
SHA512
f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
-
SSDEEP
196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD526d1ec6ee914bb29c3ac1136651085f5
SHA174364f16a34795d45343e9b35c15a403103dc247
SHA2567a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d
SHA512c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4
-
Filesize
4.9MB
MD5993bb17088b5ba8d8a3575ae67ed5a74
SHA1aea568d297566ae5eba9ab1caf6cc30e4da3bfcd
SHA2566303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709
SHA5129ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD5c33f831222e4061def062a6776724494
SHA1120b4a34b1003eec0edad50525eca66e6b8f59b6
SHA256f23a4c600b69be5349f10adf6785af10496a8a73e8165e3ea1226b141b02f7cc
SHA512d6a1f70661c31292fb036fe24841e18b86cbbd3ed3cd750e8eb09118c4796f1a5a064a6ca6ee63f8f41e495964213770e086a13ffa2d0da3af6fdf219f785ec9
-
Filesize
8KB
MD5f46233d56d6115890a0f5fc7e472574b
SHA1787765c47ca5b7fd20be2bc5631247ebd1381da1
SHA25656b9e5b429190fd5a7d016f8324155f6f49ee9d7415a4f1529f9caf7fdac597d
SHA51277e39e3210abae57034382c5aab636b0b7d090d7dcac02b0554b59cb91ca272d4d53d15b777896261b82c27d27e71e07be4404359bb9c1aa16c81fcaf93bd48e
-
Filesize
8KB
MD5e040e81d08bfa1bff6ef8e178621b4b3
SHA1220bc08c98f663238ff3e71c33079e55a951a747
SHA25621a11de9f8cb284ca71e89783f0546f4b716dd7889a3a2444c89ef37a6545b32
SHA5128af96971750cee45bff3ac887029d020c18b31173d354d9856881cac026c7c712f6ce8bfbe5566f9f065cb341aeb3b55f109ee618d4fccd2ae052984e2bef8b9
-
Filesize
256B
MD5fcbf65faf8e514d509c8d3a71ebc0af2
SHA1569b9e1df77308d2de0df8b6ce237fe18e97dffe
SHA2563fd47fd350c56173dad1db8bf1cd898cd4713ea43aa0169159d1a49677ddf771
SHA5126a3b3c5ce36208f4c28f9aaae83ec900750c9cd6e8462607c8af09b0c94d9eaaa63d9de04fd0f354d6a9ea91e12c638cee9ea2785cad828e04ad21d50fb8e2f5
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD55e31c7e4c9e91f5c3dcbab3e49f0de82
SHA1ea569a9f9d76a12b84ccfd844aea773ee627fdd1
SHA256d44c6eab617269e51e58cab9f722dac1ec028ec288ead1a29082f9b7535012d4
SHA512f2d89e9151ec3faa051c752e8071f7b981cda19cddc8b8a5535c01035dcc8e0f29e10af460eca4243b864905489d758c02c1f08ba7ff6677cd29377a50075dce
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD594bc1cf53ff5afc491660cee649f59c4
SHA13de2321590eaeced2b93d9b55b11b7730a751682
SHA256723b2a597d8cde82716ad2601a5c564d5f07a2fddb1bc95e46b150aea6bc8708
SHA512b6302466990d88a39cc202dfc76086cd03ccb2bcc5b854afcb654129214539f74a21c329666f753a479c112a028192059e549e23ac7d6039e4fc012e5b40e457
-
Filesize
16KB
MD52e1338630579541e5efe3ca8de7e83d2
SHA187bc0817ed3e03eb1fc7f6d7be9ba1c3f8e1bf24
SHA256e370ad514cc6ca53fc21e3c4716560d2d4327d11bfe7da3df1bbebea61808130
SHA5125fa80c066f63c5e8f9ef20b460f03957064c58a8279f10e3b6e728663187b867eb6a2079638812ba5935670d1691162ca0770d5eab06819fea232b122e546941
-
Filesize
108KB
MD584721b789ba5bcbd89bc5fccc968d049
SHA16314aa2d38eaf8de7b762e8206be0d0cb10a9e12
SHA256522ac49ef29c5098aa1af5f18a855f25f9617de8150ea343ff252c357498f730
SHA512cd0032fced5cade0cc17ddcf2306ab2d01b1f44c11bdf8fad5b00ddefcc6f4dcf1fbe1b30238a6aeb4a84f43389832fe81befa2d007cf93eb9ccc4cbc034ee84
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5f7c49de76e7e7a7c5992fadd4b6c5b21
SHA19d20f6a623387ec85b2a901c38b1930da4c3ef00
SHA25690b22ce4d521568fdce6e1e56888300e6a3302480ada68156f8ff736114f6432
SHA512b96c664fc18ee573d40be185b88bcb868e1124a822fa958453da3a294ded75fd52ddf68f6c9d9139fe2570f97ccb9130e94228e06d7ceb7376a0d172b8e5a569