trickmo | aba8466f8162846c8adc7be242bb78a346775804de2c14a978d69649b0639c6d

Resubmissions

25/02/2025, 17:16

250225-vs31jayl16 10

24/02/2025, 03:26

250224-dzkzvszncm 10

Analysis

max time kernel
7s
max time network
855s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
25/02/2025, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.3MB
MD5

c59b52822aa4d008e2b29372ca143179
SHA1

9adc650d28dd99e8413c3546de9195fa42aefcd5
SHA256

fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
SHA512

f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
SSDEEP

196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez

Score

10^/10

trickmo banker evasion infostealer trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json	4492	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex	4492	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex	4492	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex	4492	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
PID:4492

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
26d1ec6ee914bb29c3ac1136651085f5

SHA1
74364f16a34795d45343e9b35c15a403103dc247

SHA256
7a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d

SHA512
c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4

Download Submit
/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
993bb17088b5ba8d8a3575ae67ed5a74

SHA1
aea568d297566ae5eba9ab1caf6cc30e4da3bfcd

SHA256
6303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709

SHA512
9ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit