trickmo | aba8466f8162846c8adc7be242bb78a346775804de2c14a978d69649b0639c6d

Resubmissions

25/02/2025, 17:16

250225-vs31jayl16 10

24/02/2025, 03:26

250224-dzkzvszncm 10

Analysis

max time kernel
899s
max time network
887s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
25/02/2025, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.3MB
MD5

c59b52822aa4d008e2b29372ca143179
SHA1

9adc650d28dd99e8413c3546de9195fa42aefcd5
SHA256

fb6a726e3888842c21f274ccbd64a30962e1cd12d2472aa8c088fb052819b503
SHA512

f93c04b9ac5dbf45ef7f4dc1dfd588d45d1a0d5b5959647ab0995d83dbff433d798f84cf9d17e0336a8132a2c5b29b290c5024db2bd641a491c981c9d923a4e2
SSDEEP

196608:1k3/3jQSRVaVzbzd7u5wmS/l6LgMUyB3p6pez:e/USRVaVfJvR/l6ZNB3pAez

Score

10^/10

trickmo banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json	4339	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex	4339	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex	4339	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex	4339	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	kegvi.nfec906.cyc

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
26d1ec6ee914bb29c3ac1136651085f5

SHA1
74364f16a34795d45343e9b35c15a403103dc247

SHA256
7a8de011f6ffac3d6153a4a8aff8532f4d39de29624b1053e349d216b1190b6d

SHA512
c3c254a09e3fbc78a7250a3b18d55d1e8afc699ad2d561fc02e73017230b630a94872516da6435b897c70b3d28163b037b371d644b87c49e86ce28bf6366d9f4

Download Submit
/data/data/kegvi.nfec906.cyc/app_village/pn.json

Filesize
4.9MB

MD5
993bb17088b5ba8d8a3575ae67ed5a74

SHA1
aea568d297566ae5eba9ab1caf6cc30e4da3bfcd

SHA256
6303a6e19e20ebd78e2997b8f9ea0318f72708c7e4c02a5e83ccbbb9c24ec709

SHA512
9ed57e9a4504b98c6e6249b05051243b9a3a3dfc48c7871ff950041c1d7b93c0a953bd63db4b6f425a069c0002b609afcbbdc616c207a0a1b0b4fa9ea8d0f179

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a

Filesize
20KB

MD5
91af32c14839a2828ca58297e0861362

SHA1
bd758cc0bb47b570da2061d4633aa998a87ed971

SHA256
5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923

SHA512
9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
e944e4360ad3763e2ac394a4b92c89e6

SHA1
22b91d859f59e4b85e8db648fdb079b17cabf852

SHA256
ba9d8de9e131d5c91ada6c830fb2a4281b00da239134927b5149dba1631d97a5

SHA512
a56e7c61869915f6712ca104299d3cc629711822b38df9848b0d60bce5c29d09a4e30e68c72d005c75a99b52d64102d21d40b56a887ceffbff05dc7a8659f0a1

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
8KB

MD5
f6c82786d78f33c6f797c94adfe87da4

SHA1
087d4a06a9cfd1a9659373a9d29a2894f07bcbff

SHA256
0dee01cf889b2788ab8425c34c21d2d55d8f9ae4839409fbf87ceca5b116993a

SHA512
38c0c896b9729d188776927c05ac75894b69b35a72928e55f9a0992696937c1e0cfffaf25becfab65fb889700782318641b0d44e6e2b3ae69b936200c63d22de

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
8KB

MD5
7d3246471c2729f9f406116ebb93b336

SHA1
90007809a11c92011f16304bcb3bd19049a994c4

SHA256
4fe284c792ea4aedbe2915fb96297f5129c23cea6f367ba3dd5332dc5c64e38a

SHA512
6ff2c7dba5bdd8e4c328a8f2dc9d2e634d1414a9b274629a350e6501439ff42820f56396abea026444263586d81ade92df3dda58988f711975910b35ba2c684a

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
ed8b5bf98223475fa6a956ea11111d57

SHA1
dd8025d9f7c0508c42d6fddfe62d678ee0c40c09

SHA256
ec6bfc0dc8f9dcb9a62cd47f8d734691c44102a14cbdeb9b9f657aa2688ad7af

SHA512
6f9a4acab5fe740c095c3ab1feb604426f8bee59d93ce60f25229795e3bbd3f803b7085dd97d25ffa8b6f38f0badc5ebe18fc918260ff7dfe0f52a1cc170cf1b

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
42ee18a8f4a700c0ffccb273f9905255

SHA1
f3bb0c9f7d57a8eedca2f68a09b37e3a2c76a87e

SHA256
661abaf25aa9e4812c8325fcb22bd187c1da8d1cd44f6cc23f083523dcb7ab14

SHA512
db213067a7ac4e71c85595f0f0a72a74ef4c362ff4eb19252279ef654b6da009eec71930f70c5aff1d1a0486b026ad41e85556a8145490465457d515feefcd01

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
578ff4aea0223e950c3a077052879662

SHA1
8b000de5d192e9d2b80b757218f718095e922761

SHA256
d81443b8de577dc875db884ee24242dadd5dbe06a1b1583c080ba23812df6b43

SHA512
da0e341d8b80e9af980b47eecbca77a6474200e5cadff06aee38dbfdd96f8604b4b273c23474a3f188c2324cec4577105e3b22417fe32973f965cdbf09eb486f

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
4584a880612800429103d860e200fbce

SHA1
8cc08616b3a43a030e7b1a1491ea2b7afac9e020

SHA256
bc08fbb9ec90b53df9d3de7d82d87023fe203528206f41fd42d6f57ff59eec28

SHA512
bf360a6d9aec4241e0561b4970f52c1ecd86fd382b5c20a53625f5602037f0b93446e7ff3853e6143a6eea82d2a97e5e94fca370c97b176ccbebc8e66560e97f

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
7713e0eb309941f620efc7bda4e5e53a

SHA1
3d12b9f5d30767e9f9b7b0257ac600db0acc30c2

SHA256
d2e542cd5cd444035335569f38f30d840ee7e36edc86da662db03c46f1385c9c

SHA512
770247d5bc46e1344fd5fd2a32226be472c7d5c1939dd414dd3770ac6d5ddcb25e925b81f624bf5a7d4ec52ec51637527dac49883b0753f77cb49a0262d0e4fb

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_village/pn.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
3460d7af7e8dbacd1c9e56b9daa07861

SHA1
134a19bdb17ec4b83a960fd674ff81e8dc174461

SHA256
2a9624c1b25d55c72de7bfe487fd371f5304ebcc7b5f2ad6ea968a319a16b52b

SHA512
b8b4d750e1dbf92d94fed483b2085c0ee964494289fee76adad1dad6fa1dfd1a14a799123af84741ce154ceb49b5a783dfd1ae1f2066b6103894588e6a4a6420

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-19-02.txt (deleted)

Filesize
1001B

MD5
1c56b419f043be564ccf85c040ba4758

SHA1
28c97c81599d098b2034aa18abfc72c6c26ea956

SHA256
e37f82553044557524cb0b7d2de8623384e03ba01d61cf1de79b2335577c00e5

SHA512
ccdc36a1535485c1b62c64ed3ab1f1ae630494e4590506147468bbf0cddd5f5aad538a576a124da28637cd6e138c25ef91433d048ae8422b0d40772d6ae6fd24

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-19-02.txt.zip (deleted)

Filesize
214B

MD5
368c38fae443609ed373514a0883b189

SHA1
3f4b35172e62b6b5c4bc97593dff6f011a8106cd

SHA256
844e812b75770151b1190ac2b02c1cb053a63794c6e500c987c1a95fa89e6c6e

SHA512
20b7d8ab8ed57e9d9a123c3720a3cd56c206f4003bf01fad8b8cb928eb7bcdb2f41ba87ed2d0c5f7827435bdbde6079f373c1137860f58f9aebd772297b03dbc

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-19-06.txt

Filesize
31KB

MD5
4d571fc789875ef5fbdf95d15daf1d6b

SHA1
d7e2096fca873394820abe099092d20f19cb87b5

SHA256
02b1676e97d515c7212e11f941b3f9344a4c4f8669a96b6dfe2ec792a688b829

SHA512
7458bb1795fb07949eb12cc9ad9aca8a440be09b547e67387657cd84f93ba276fa231d97f085926528ea52115a5e72646a071c82b74e10c45d74bdef52b1b2dc

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-19-06.txt (deleted)

Filesize
15KB

MD5
92a4e81ee3928b07259cd453ab3ab905

SHA1
fb9f3cb0812300f938103f57e88bf37a1fb83c5d

SHA256
c3f2dd371c85335ac453f781b346a65e54d7348bbcc8b393328921b1e14fd368

SHA512
40b477700e33ed3af3b4425a177a7ecd66682d10f263fc3f50607836cca3afa27860889678de530bbcacdead185c94484c4a79495ce7bb698b3b1bc2539846fd

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-19-06.txt.zip (deleted)

Filesize
1KB

MD5
42a88b692d2a84da0d14c8e86408a3bb

SHA1
f5ac4a392241a490471d9b7f81333deb3271860f

SHA256
fd26398f38c9db7b7f3333e6b474a6d7adef33b13c1a359de7a5cc7ce01f0f8a

SHA512
548cfa346c2311c93c331c925fcd734f393bb6abd63e7bf84842ea998228635fd471c4478f92e901a739f88d288cd983b8edc4a550bd5c23f2831cb261c2e1be

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.android.settings_2025-02-25-17-20-45.txt.zip (deleted)

Filesize
214B

MD5
e523d1458df87c109ec27172b16a7b29

SHA1
a8c69cc8f11b52c78df21b6cd6e3a72c7052d153

SHA256
db06eb8d02911c4cdc09a0c3e5d87479f4f1b4204e858ce43e28c727823d6d8d

SHA512
39376fe6cf0d5026d31ac2d10140f725c52b5bca34393a7a4d93bd2db0b65b2d7c00bc4f3db75e44dc4e22be3805db20797b41a5115b19aa5b614bbb714ee974

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.google.android.permissioncontroller_2025-02-25-17-18-55.txt (deleted)

Filesize
5KB

MD5
65e719ad6d571afec89136e520c4edba

SHA1
e735724a1722fcf770ff949a3fb59e05acc8bd00

SHA256
da69f5904834b349e4b7e537f21c8251a251bed62a3d69f6c7b99ce2e90b08a5

SHA512
073230fcb27e5168924712ea3510ba0fd3d409dbbd2b5fb9e8c8eb7e4a191075900e4e1539b7ca26f98c88cb486c5cdaf09f2cfd47170b99f51b407d9e3154de

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/records/com.google.android.permissioncontroller_2025-02-25-17-18-55.txt.zip (deleted)

Filesize
1010B

MD5
6ef00c11701985ded870ea4931b1dd07

SHA1
043cf86b16fd67a4df0b1b36990ee7538f12ef18

SHA256
356b1ebb5d80c00061d96a572f386f12908a48e01c872d9cc990404ad8846406

SHA512
3bc56f2139d02c32984529941c9297b6f310cbfbd7ef802fcf095b2a6c29796077a22db3e43a0ea581f787373f18fd7be5e9bc39fd3c6fe64b3d1f8a825a3518

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads