trickmo | bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2

Analysis

max time kernel
28s
max time network
26s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2.apk
Size

7.4MB
MD5

b228cff097466d7a5077ef6ac94ac862
SHA1

3405bbe0c7703dbb6e5829b90e25d0efebe6b9d7
SHA256

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
SHA512

f807fadd8e450c7b2a53ed387211059046cdd4fa030a0f7c6525e983e4fa3d263ce86bb9e4c9804fa239a0e57e016d703761b055e3dc0efd68327d5ca4e8b4ba
SSDEEP

196608:8XBBT18xyoVgPdynjh9Z7qNK3zI7cS83nP4/nh7jTi72I+5FZzorwUWDV:+XT1Mcc9Z7wb7of4/h7jQ2jOrRM

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hinjohn.dad249.ta/app_love/By.json	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json	4304	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex	4304	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex	4304	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex	4304	hinjohn.dad249.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hinjohn.dad249.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hinjohn.dad249.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hinjohn.dad249.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	hinjohn.dad249.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hinjohn.dad249.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	hinjohn.dad249.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hinjohn.dad249.ta

hinjohn.dad249.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4304
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hinjohn.dad249.ta/app_love/By.json

Filesize
5.2MB

MD5
4fbb4028718532d32e22239261a76c29

SHA1
21291bfaab1fe037a003feaf8fd8ca01c800dd6a

SHA256
ad0581c6e1a840d93765648b854037e116402f247126ff01eaf6e37e6298c120

SHA512
92bde62f07d7953ed5f048acc0349ff6ffab105abf6dfcc1e4011873df7d649ddbbbd68bd0d6f47677f8ea08d6f1912e653ee274ba3895c07a70c9499c078979

Download Submit
/data/data/hinjohn.dad249.ta/app_love/By.json

Filesize
5.2MB

MD5
02bb31370c476d5d188123d472930ccd

SHA1
41423584d5c1cc00ee94541e7a42c7b75d215079

SHA256
daed2788794875c06c74734d96fa2ce8de613defa13b7355f3be5033f66a1055

SHA512
17b5dbb3fa3dbed0e9bfa2702ec7c25b43794b7b70bed37810d8b45f0e4d1a50951f2c350fde2d5ecd7b77d961c20cc70e39d24ac7492e965d6977dd7b4741d2

Download Submit
/data/data/hinjohn.dad249.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
512B

MD5
c9c9ebba2affcd4e4f89d26846da1cae

SHA1
6f7056d9f94ec91df17c32d9041e02d5c443dae4

SHA256
5b537991d5be72095969aa38e6eb75174b2ca472ec8be450985fddd0f35a7a06

SHA512
b93826d96f483f85a858338b0f8ae79398695cc490944875d5a7bd55924bb73b1947b6e89358ad2eccd50436a9f6a3d6f674fa78533dc560c7c251342e9e607e

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-wal

Filesize
32KB

MD5
e62f6352ce1e55a55b6b5b11885aefc3

SHA1
d0d963766b75281657359518798e3157a6032da2

SHA256
6fb6df6381b4d6eaa66d999009d11e7247009a98a4af893d62b5c343807942a1

SHA512
5e7e7adec75084ac5d40e9eb83529cae3127e85111ba3f5559d000137caa67b2cbf554ac5051c06fa9fbc0f14b35fa591876a5cb0bc6a5cbcae5451f4cacdcc3

Download Submit
/data/data/hinjohn.dad249.ta/files/hinjohn.dad249.ta

Filesize
256B

MD5
9ccb32f7a67c47e58df6a2fdb7ef2c90

SHA1
662923d46c2bcec3c5fe7eb368457e122ed81f65

SHA256
33f4081325c1dcebd937565e9137acc8a0ca2625814eef2294e0634c30f6d619

SHA512
644a1d147f0faa2a56933e6b5caf06a66ed52642008b10cba38ff037ac5dcd2697a716bf02c8070dd393d1ea46755c4484f91a99d4f8644adcc2d51db0e5ecb6

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
88da12090246d0b9bb7476b504e3f174

SHA1
e7e0f993e933ccad75105b241e787f6d681321ec

SHA256
01151fc2a7c30c3027d1ccb4bab6a6b8d9095b0343f2615f5b515f84ee465e1f

SHA512
113bebd09ff53f54ee2e21d6edf8ba7b8aa6d244e762e4fa4a05a8258e913952621825d317dcb900bf95762e2d7a4243bf2d7ef3094b07e6cc0b7f44f4af1ccb

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
96b5b253866958caaaaca936338ccaa4

SHA1
a159013fbe3ddadb56e8b75122af297459d41add

SHA256
184ded7030c3aad0d321a48122a5b41d44b9a81ce43f9c424348fd90485f6f2e

SHA512
d844e0ebbb6ae061198fc25ab0dac3625711477eb64eb2be99c2fab0fc9ad4d8911e6a98749c4c8606890a3643225410020868b1146d0afbcd521274ac5c7e21

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b42e1b574692d2590ef6934b11ef7429

SHA1
7576dfa9b76812e8a714f5661d39b57f585e015a

SHA256
b96de06984d9514facd50d2bb6cacd31d0686db80dd11e45509a401edd4c630d

SHA512
c5135ca82ced6a327259c4ecf2c4a15a1e2d48b280ec2236a889063678644cce3e048fe9b8dd98a6cf8afa3510860be22005df04143c9492b4f2c193ce1cc5c4

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
21fdf4c2a09661d8e1824d46ebd97625

SHA1
2da54948c6831569f9f80d605fc4baeb81b74a16

SHA256
1c27d39195e52c615601ed1865456ee46f7f243feabd98f541b041da42b34a1b

SHA512
7c33c0eb31e2c0c9baa412a7d89b0b62ea4c92f4f298d91a47e18265e47373bcb040eb21e09f7e0a45c2750c6f3867541d0ab888c286b716eba9c0caecc1a220

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex

Filesize
351KB

MD5
5a6c21c97564f9a1e87f8d7f10c4a768

SHA1
1e5f3c0425f58d762043761315dbe272245a6be6

SHA256
0560c1387efd41865f075e176b7d4875340db043d943c95f0ad11f0f684fc519

SHA512
e823cfa4c5dd345e9f68aeeac384d42797ed1419eb70ea99d122a6c20a066a97fb94ce7dd6037b743d82eaa21bab2974213027c5e3a03af95c6c8ec513b7ec6b

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex

Filesize
257KB

MD5
b9c73c4d9fcf118ac64a47bdfb8bb561

SHA1
f74dec2bb9dc1c5050ad66937ecb844b915a06b9

SHA256
31b28132c9fac2f1062b7eeb45e2c281d65d19dc03805a7e4e4122fa492ffb1c

SHA512
750c57fa2798de21de00d20cd86cab0c12e4e7d5d3c8978f6c674fec404b6aacfa9b3bdf03d0da0f0bb16fd62928dc625e3ccb135699757bd16ec3e7e379d375

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/hinjohn.dad249.ta/cache/logs/log.txt

Filesize
83B

MD5
e79ea6eca02761f59898e614e6db6ec4

SHA1
b543b431791df546b031fd33967d6bcf865b123d

SHA256
4c5fc067f9f0e0e776f9e42689ab0d8de9dff39de5df70ea4286d02a7c60a449

SHA512
e153cd384c97c3345970c9b181118dacd29d6c6e461325958af5223f39c3afbe62c30c1e2bfb63858ff3a4bb8147bd86b15c817024292ad8e781cca585998055

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads