trickmo | 353e47a046b3af6212f98844b18a2ae79963cb8d2b98eb6bd5184296299ec372

Analysis

max time kernel
29s
max time network
26s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

8.1MB
MD5

720c616bd3e4f7fadde344194a5cd7a4
SHA1

001fea85badda450146082038c6a5ce8b9878fd2
SHA256

42009a836376a2ca77ca8fc1dad73eca3634df7b6c5ac2091ee0ea53661dd725
SHA512

282e2a9256318201caeeff668f4fcd1e93bae0b63d708ac99fb267369299b4b128338b727d55f2d7ef3460295b75e3be0dbd0710beca4c3d5bfdc9bc166ffd3e
SSDEEP

196608:lyiCDijCX0oAES/KCmxU7UBnBsXmpF56Wf2GGUTx:q6dE8KRgUFBs2pF5bYUTx

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://mikejprdanorg.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json	4283	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/landtual.pomf70.ta/app_suggest/oat/x86/EdZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes2.dex	4283	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/landtual.pomf70.ta/app_suggest/oat/x86/EdZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes3.dex	4283	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/landtual.pomf70.ta/app_suggest/oat/x86/EdZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes4.dex	4283	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/landtual.pomf70.ta/app_suggest/oat/x86/EdZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json	4256	landtual.pomf70.ta
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes2.dex	4256	landtual.pomf70.ta
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes3.dex	4256	landtual.pomf70.ta
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes4.dex	4256	landtual.pomf70.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	landtual.pomf70.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	landtual.pomf70.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	landtual.pomf70.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	landtual.pomf70.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	landtual.pomf70.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	landtual.pomf70.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	landtual.pomf70.ta

landtual.pomf70.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4256
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/landtual.pomf70.ta/app_suggest/oat/x86/EdZ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/landtual.pomf70.ta/app_suggest/EdZ.json

Filesize
4.9MB

MD5
7eda39fb990a24bac58f5d6e955ee667

SHA1
e90608e181ac701ddf0b7898a588a4788d62a2f3

SHA256
e1ac88df0be2b14ff34eab4e9150fcb075987e47cc3bc8b4660d5c7e43f5b328

SHA512
ce741115cc895767eba73712ca5bc82416cd16226a666611a623f1b4c876d19472c01289842ecaf74528763b8d8a61149fcca67da138b31cf42cf99b1ae5dee4

Download Submit
/data/data/landtual.pomf70.ta/app_suggest/EdZ.json

Filesize
4.9MB

MD5
73b51fb51a7c1838642325dd9aa03732

SHA1
f1963286c4e4fae80593fa5555613bfce95c9f51

SHA256
a612724a99d62d5bce2470e91cb7d114ff90dea5c722fad0559eb3ab310b80cb

SHA512
c0d2201da10c0817b608c881263557432c88864fb97c5ce67d2d7ab7a257f3f7ca979555eaac33322c96e09f08ea1ed002c0ada0f624864ae01c7dd37f5141cf

Download Submit
/data/data/landtual.pomf70.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/landtual.pomf70.ta/databases/a-journal

Filesize
512B

MD5
34f39af52a47d6afc31ee354b7f83c74

SHA1
500b36acec69a9bdce0346e302530884ccf4a0a1

SHA256
6d3c79090d53ded91058081096570d754d85127be7c772e78c835d9a834acac6

SHA512
4b62e7c996a646877c1df76b04d7ff72dc4cb98851def59699bc15da5326a271c6e213529dbdf8115d929defbffb1b659d69785f0ac42ff0d19e180127f80659

Download Submit
/data/data/landtual.pomf70.ta/databases/a-wal

Filesize
32KB

MD5
b098217037913274840b527e292002e5

SHA1
6ce0fc9858831f475fc1f9fa4e5cab387cd6345a

SHA256
8b9254a158f4db12ef2189ec20e07088668f6dfde60388328d661119a171d75c

SHA512
fb72a69767ac28c17ffa2f4b835cb85993c2a1dbd9311531178fc9497000f10c6b7ba7ae8a3d26feedf3a65437fc20e856ed0f10aee66edf816f561e09925720

Download Submit
/data/data/landtual.pomf70.ta/files/landtual.pomf70.ta

Filesize
256B

MD5
e1fabffb379d02cc48c6e5cf99d83306

SHA1
d4592666f0513e6e346cd9c4cd8c851f96f6ef38

SHA256
f1951772e6ef651ae22a550e115eedac16226ca9c2d81be85dc616bf297d9cb8

SHA512
557ba0d4482fcf9a19cd5ffb1802827ce67aef36dbff660a165ba50dca8157ce8a0482956b673dadffb80e03035383f7760c887e53ecb309d9bce762c2540f4d

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
24464c197875f46cadb5a06aa40111d8

SHA1
8f97d136432e2ea1c31ca9c0be485821188f378d

SHA256
7d4d56fe37413b260e3acfde2cda487c20b1ea29ab00ec46ce8c6d389c1abcee

SHA512
5f1a51e7fc0ab84ae2d430af4f55061272b7e69c1cc015af1e9d83e3cbc078915d683bd6de063e5e7802cf814c46fd8034e3c59d09020fb952db64138826af6b

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9f4d3fb407388b5cf91110af49c7e421

SHA1
038a914751d09eb331717a391a8182ef64241ae3

SHA256
2895255b065e8ba1883070ae5603980c1b7d619c897f84885fb157391db5f3df

SHA512
4b98a3e6efa4ff63dbba87c4008ec949f81c67065a70b535aed3d76728c7b75e86bd78fe3b2ed17508c0a38f21135f27fd7b2ea5656093b6487f096849e44086

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b308c0fc98eda1119d21cb55a820146d

SHA1
3ad973fe8c5faf59b45823ad7e349bc094eabd59

SHA256
6beec1eb5c97ef686a82104bf6e853cdb59f92b96b5253834b946f56f6474dde

SHA512
6d1b10320855117c89d150900552c5cceb5c79efdc1ebcbad7792ec1ac91a616dcf620167989a5f7da52c0da5fbff381338a30319d2f44dd6731cc822cdda77b

Download Submit
/data/data/landtual.pomf70.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
fe3fc3528e2c1e3e7f503126122979c3

SHA1
2184b84f2fe71d59d27899b7d043b8e3db4aba96

SHA256
c631fbee96764a0a9ef4cc87ac8df7a7ff19faa23ddc6a7a08ed8228b6ed99b9

SHA512
f1a865ef19c42c24322e8c4944137ce249672535c1ae4eee573e2dd56fc8ad5f58394ebf915f47fc7f48edfdcf63da5d9269699ea1a7e088ea62d5b8e73ef1da

Download Submit
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes2.dex

Filesize
308KB

MD5
7f553f50925945c7d7138227ae983377

SHA1
d7d3afcd10dd4e03daefa0e8e242c1a7b77a7162

SHA256
10d07387bd954b877c1d1205814d36bf526108b16f8fc55fe48398d350166637

SHA512
2202dad0a09b8359f4b07f2f5da2777f4d3a70931825440da3d4bb13639b981917616f6fe394dc093aab044bd6ec7e47e363d2665b47aea21a0540008083ec1b

Download Submit
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes3.dex

Filesize
265KB

MD5
9be81be1b34d2c5b45f8ca690fbcdfb6

SHA1
10300ac02fd9b57f4de8edda3f68ccc1bfab9e6f

SHA256
a9081622945a79c3a4209e8d84c8cdeeb30a6b4ac5e8c4c80703d04fd1841b04

SHA512
6969fd501aedfce16d2f1d3c2381765687f8f978072a7fa81ead3e1d9e5dec3cf98bcf6403fec47772fd01d137232fd645deddf8c7d640af887f896c2087658d

Download Submit
/data/user/0/landtual.pomf70.ta/app_suggest/EdZ.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/landtual.pomf70.ta/cache/logs/log.txt

Filesize
83B

MD5
ee3af9db86dc93903bab0f1ac69dc207

SHA1
27b315589ec60d005d7fee12e8dbf7bf4fa98c65

SHA256
442d83b27fd0ad62903615c8e0b9930c077888e53489d596cb426da843650ae3

SHA512
28e4dcd9b5a29f80cd8669e5b8ac8770684d32fe7ffdcf95b6b479c2a71d12ac24d0994e466a70c0de9ac8f609c22ff3f542e1be54a9cc483d85b782b6a9603b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads