trickmo | 8e771c741524079af630c15a6737745192540c3cd34d50ab0e97ebf2714acb94

Analysis

max time kernel
14s
max time network
27s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

8.0MB
MD5

59fc7c31e72d195d01724fb5bd83ce76
SHA1

d534d35c519c3741e9b809b4127d9acf1fad77a6
SHA256

726286d62c75677400e56e05e12231a9ed157c618425e591757872ac8a04c86f
SHA512

1e084e2598132587648212df471f2378279458fd3531764764e35eacd3faf1eba5bf47442dffc0496a34044323d3277f97f748db2753f34ed8b16a6a833c9e56
SSDEEP

98304:w3eJMz2g+RqU7FWiIsoE7NKA0yOpwS11slxBuwE15LI+cSUU29Hr1X1YvVA6KHCk:/8XU7FR7rO5LwiQSg9XYv9qCtk8hFbmL

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://mikejprdanorg.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terpnetf.plac292.nan/app_mystery/oat/x86/Dgqe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes2.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terpnetf.plac292.nan/app_mystery/oat/x86/Dgqe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes3.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terpnetf.plac292.nan/app_mystery/oat/x86/Dgqe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes4.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terpnetf.plac292.nan/app_mystery/oat/x86/Dgqe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json	4304	terpnetf.plac292.nan
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes2.dex	4304	terpnetf.plac292.nan
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes3.dex	4304	terpnetf.plac292.nan
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes4.dex	4304	terpnetf.plac292.nan

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	terpnetf.plac292.nan

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	terpnetf.plac292.nan

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	terpnetf.plac292.nan

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	terpnetf.plac292.nan

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	terpnetf.plac292.nan

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	terpnetf.plac292.nan

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	terpnetf.plac292.nan

terpnetf.plac292.nan
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4304
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terpnetf.plac292.nan/app_mystery/oat/x86/Dgqe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/terpnetf.plac292.nan/app_mystery/Dgqe.json

Filesize
5.2MB

MD5
2b24f0dde8685dad2f2ebdd2392146af

SHA1
d8b8f6d3df8f51ecddee6be5b06842c2ff9061b7

SHA256
291cea72f104212fd27741a44d589e0fe09a23984e6a95972bac4547069f2748

SHA512
a2845b0c06f5c6819d7eef62a7cf334611e9212a14b19f303cc7264debe3d9bed31f357c85784d1c2b5bec8bec8af2165f87bfbae3d46d758de2fd1e2509733c

Download Submit
/data/data/terpnetf.plac292.nan/app_mystery/Dgqe.json

Filesize
5.2MB

MD5
d4ebd024d695d6860a72000ec2d5cc03

SHA1
aed4284dd4e3655fbbe468f819452d9095e3cbcd

SHA256
6a92f157b46d0ddadcb3a05d5a427230fbaff40ee6bd6cd9f3a0a4865d2ca7c6

SHA512
0d6905d12b4a063a00e2805342ae2f2982846444a7afbd115a89b170ae3c782feb6788d6e294ca9afe4618f8cdc96da64d76dcce527ec5b19a8edd3f7edcbde6

Download Submit
/data/data/terpnetf.plac292.nan/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/terpnetf.plac292.nan/databases/a-journal

Filesize
512B

MD5
1251a774e38268cfe7ebee6a5fe66fe0

SHA1
dcfa9a3af60cb0aa0488ed379a902dda2b995a37

SHA256
646fddb18da20700f05ea7abfc03d8a0824d547ed89a343e7b8a800eda633923

SHA512
ccdff713e96c558879d045eb4d98145a6c709d64eca13cb1a43ad7c21b80593cc72f4af647a46ec10187c0bdf75ab5147dab6ed8a217ae7163bc361e55e38448

Download Submit
/data/data/terpnetf.plac292.nan/databases/a-wal

Filesize
32KB

MD5
df058e6edb274f713eb000a1416553bb

SHA1
45aff1a8cfe8697ec82c93c42caacfa4e9e47c0a

SHA256
687ce341f7fc9e5f44a36737d1197839b66caa1fcda24e6dedd17f4572cb7c33

SHA512
d44d2f60f431f812045e2adc049e3e44cb2622cdc3354a0ec6a2796704171dbc35eda09324f8aac60b609a0b4b7143919f305a6ae8c4f296e72d6bd827c7cf32

Download Submit
/data/data/terpnetf.plac292.nan/files/terpnetf.plac292.nan

Filesize
256B

MD5
6fd5d04bc7fc882efcec4abbc6ac33e2

SHA1
ed888b88d5e0eaff1184f49e152c0ca528207e96

SHA256
ae3229979c04a9b98a2ffcc72552a6f3bfd4325929c4563368f852c361c65383

SHA512
f7cea72067766273c70c1b36c6caa2e54da6f142095fcec085b1052374c2c3a1185588c960977b9144979e85466a37c97cfe47a526ae4741aedccdeb55c84da9

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
400c9b92d31c9b5294ce31c6c9db8f00

SHA1
6d7dd1c6eb79ef796cc22ad076f844c17a25f17a

SHA256
46d2ed4dddbeacb48f403640d7bb938b1dc6512bf6f3d5ddd0ec24f8aaa816ac

SHA512
68fbe827fa0a6fec885ae76b76f9aebb1943fddd7bd63ea814f2360316763520b5866739a5cd992f6c6f5d27d025b085d8c17a9e3409445750a5a9494880a0a6

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0ce896d779a0a8dcad392cd429b4b7d5

SHA1
6789c32b8fa579811950cc7e52ce6b3bff84f36f

SHA256
58fad384e131a4f194e9f70fcb63fd371a0ae362767c0deac9b144875691b262

SHA512
661c6521993961a269ffdd76be66bf2165f894d7ea139d5e199fdf1102ea8cde45ff3377d4aeaa66153647b12bec910ae23f60e1f2e0fa20320f9c586ca13d6f

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a46e3627b60680875e661ae27042fc61

SHA1
3f62ef08211aa0c281387c50eb61f2e4a6a33277

SHA256
edb112831ae4c714abd65d9702aadd591400c2449c18f50d01c08a23cef80f1c

SHA512
cab1c619187aeba26423e615b4256770521535100ab633a1688b0a620a9225bdfc423fe621dad432e9b5a0725364599688800a8007f0fe00ee0cfee2e873ec00

Download Submit
/data/data/terpnetf.plac292.nan/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
9dbd06047cf40239ce3c8957df824315

SHA1
d444f193bfad9b03d829d126a899b67ba9788869

SHA256
d4c788845b689bd35f148e784a4bb7067333e7286084e73f21ad59c2d93e1bec

SHA512
cbaad0162b6373c8bc1ec74b352eb4a9ab7c26a0b27e0435a6b723bca557a8645ea1c06dde9e66eda1842157965fa72d91ddafa707e0d0136f449fa96c4a1397

Download Submit
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes2.dex

Filesize
351KB

MD5
385d6a4bd9e2e5a8931dac986b19482e

SHA1
656b7ac0491f176eac076d2ce557324834477b9c

SHA256
e11016a53aa7e04ca148ebcfe61bf27c3eac1378e4e1dfad9b10ded6198ae6fe

SHA512
4364e40766a5bb6eea0929bac6383a7e4e203c69fafd83f78f212f6d8674c894f7515db0df2a988098b9eefdf5a3cabf7ab3dc1f292d8c50d7be0491716daced

Download Submit
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes3.dex

Filesize
267KB

MD5
77ac30d0255ca3fead968cf078c9a7f5

SHA1
f56ffbf1bbc90409f162f0eab8cfe25b2340238b

SHA256
2eb45ed98b52c10f0828daff543def5d0e4b4956284dc9524fd78ddea844c025

SHA512
b545d68184dba8a535677378c9215d3c23bc1ffd41a2b1d3c95be48e81405f7febb2a4dccb0b7525cb72dac72583b8dfadc057a8f9a88f22d81c06e31518d915

Download Submit
/data/user/0/terpnetf.plac292.nan/app_mystery/Dgqe.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/terpnetf.plac292.nan/cache/logs/log.txt

Filesize
83B

MD5
a03c0a8b7d82c6c2d2eaa1250ede2c53

SHA1
5f53eaaf788f746d8acd7b902e872ab75d684d58

SHA256
7a23a231184a395f0d4319104e54595dd1fd34710b14e2075093af5956d1b904

SHA512
2371564d50d7f5164f87b0061fb736830b49d936f4f3359e571e087e0f1080c436fc6703fc2e32c19e099f6ebf76dc71251a0b212e6e81c9411047c1666eddfa

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads