Analysis
-
max time kernel
28s -
max time network
26s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
21/03/2025, 23:59
General
-
Target
d92c8fd829d80c9b0700fd077957d8a00ff17064b001d147233b971aea0e442f.apk
-
Size
8.8MB
-
MD5
b8749ed305053ea52cb866fd6dd7444c
-
SHA1
cd9931622abdaca64ee70021965606a199c2bc12
-
SHA256
d92c8fd829d80c9b0700fd077957d8a00ff17064b001d147233b971aea0e442f
-
SHA512
6d2dc1cde0dd94ed4ce4abef7334f5e703559a6d2749bbed2cfa264c4b6a5cad45716fcad47f506777f3e73c6dfd23c9d538e607b4012e46227d29362935e5bc
-
SSDEEP
196608:JbUoY2S7vhEYoQRl90WGQ647qfsrLgbO6JL1gf408gBArrX/s0WbhJ:JbUoYvhN90LH47qUaL1g5tAXPFWbP
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 8 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD53e8400a08084ec943082a6246f7dd421
SHA1690fdfbceacf7fcdb56d16ec6af727d98460518e
SHA256f12d935dee605f160e2b1df9686b55d651b0ef8f86aaf4ae61e3907768ec0556
SHA51205fe6ca0c0f7f7f9bcb1bda5668e19a522e5415098a337b2d3d1de400a90eaadf036c827d085f62b74a03a8fa5c907ddf2ec922589ac72bb6d5469bc0ecd24b4
-
Filesize
4.9MB
MD5f0b0515dc0a5a55f5cd9bc40cf195ac5
SHA127e15c3fefd383c14d390c800c56dd749960f8c3
SHA25653b58627764de1e0acb24cf5b377b66903aabc04cdbe1485c9ca66b319439b37
SHA512db36b180f24d421894ac9bf250d97ed56d2105e97ade8eff9892a8f35ee7fab0ff010699eac579717a82ce23899fc119ed5a25c11f9d328061fcaca223ef11a6
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
512B
MD5eb6540e08d41c8293c0bbabb255dc120
SHA149585f992e49e6a657beb4f3af5e3fee94b73cc4
SHA2565ec698bad862880ffd0091d4ebdd0c4fd5ae3b3d9d08efb7c75241d614a44375
SHA512ba30225a08f0f8b3fbed30affab7901a4ac4aea6818dafca63a4aaa5189e7273f6ede2ffc3cc67ad64d9f7a64d07bd0b37fc98e502d14b1e36cc293754166bfa
-
Filesize
32KB
MD5be4fb3c77114dadae688f13b328f8e9c
SHA1077d1ebdab5851814b7e362c40b514032acf1874
SHA256ecfe46c951023154ecb3ad91cdc357072053ea7a27d0bec0cdf775c1995529c9
SHA5129526ab170af7d0bf0accc6411c7b3427d0d04c350d1f5f3d5bea5dc3c718f5c2d12e4c062f19f5b74ff9163e3aef1c609fdcd277916c527b92eeb04830798a79
-
Filesize
256B
MD52419ea44005158c55bcfe7fae54f573f
SHA11b0dea47c74f8f68095f6a3ee0018ff9171eabbb
SHA25638ed1bafc96864322b40f45fe2999170ab88ad23a0e96ad9149c95ff155cf262
SHA512e3d780adc2fa72d5334b3d628dc922af707cf144c463c2ae66e86a56f48bc43411ad150bae568103eb6e05d6d6b53123c5dfe2235ee0b38d2be62990f5b96ca2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5588294aed840c3de83802f1af070372d
SHA1fef86a3cd5759d5bdc36608dc60152fdfac5f573
SHA2563bb203c57939ae161dee86f27392b362cbdf5a35f2b8aab29ffd59d46e4edd87
SHA512a99f4d95ed770a9be3d027ae987a9f83f3b7a042d0bb440c99f2286b968f51234b970ee93cd718b96690d89d61bf8982f3cc9967210b760e2de8c822fe562ca9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5a4740554f8983fad25be3799a110628b
SHA19dc642929e240cdaa00f9ea354e6f6a01e807672
SHA25618ac26f8f4d98be8c0c869b3c14bbeedca99e2a90028924c4a18ae181a6c8176
SHA5123a4b2541ec01aa1bc8e7e1c68ca55f79cd01c8bec22acaf90e308c17b1d78daf1ca3aae43996fa069bb67770e71ce05e41186c5fc8801f533d4115ca95302ac6
-
Filesize
173KB
MD5d07d9a6fd251a50cc6bf360505e6d696
SHA14a8675c094c641cf8efd626b7f84a927813356e2
SHA2561f1f2dbec1ec0727bd5487438c0abf9866e92d2534f6140b2e5921b8c5c85932
SHA5127abb5bcb6fc12853acd6929f3649f3e66f536524aac7d900e2e85764c29e8be32cca4f0852c1139546d1caea7c2d9acbb513257f009f197d395e57835fb6d229
-
Filesize
16KB
MD557083eafeca381418a137a8469298d2f
SHA14469a50f3ec598086a3acb3a09416b33cb7cd6e0
SHA256573381b800ea6517dcfeb4c71e98547474db0e860c0145b3c864d7a60b76e5a3
SHA512f481a4598c318068e9dda93b1ed6031765fbcb2a61a89a5c374ea06f3eb0f1a201132f68d2d61945496992d9ccd8d8475ebb7f892f0e02b5e0241799d7118991
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5c32c02d61605a7f33d430aa1947da843
SHA182af47c997a8059ef9a0373a0cb0f1c872929052
SHA2566c2b54a80d1fe8d7e12bd2158ca685d80a92f32e2ca9d969ea81345ddf78a280
SHA51263100b574a5692461fa4d648f47415ddd7659b34462a7b5507dba12157f5cf6388b9d19c201396ce85d10f7e25f6240670ee1a2899711ccb0121ca593eaa122d