trickmo | 9e5da5bf917acd4132c8b3d4b63af9b23d7bc16e71e51bffcd4a82162e598394

Analysis

max time kernel
29s
max time network
28s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.6MB
MD5

3be791e432b3ef50c0c947968afb41b1
SHA1

6aecf3056085a44d709879f726b36447ee9f5610
SHA256

6c968e052fdb59730897cc37a0e61e69a8c5a20f04400c0276534ae0604c430d
SHA512

9def8ad356092a24e936c735b9fb3122a7dfa559c5b2ba2ac8e92428accf4bfadff77c51e893acb917fc6b758de99986c66bd90d8135d5ac89e99e1dd5d952b6
SSDEEP

196608:xtK7pfMaBf8C4GfJCtMJCp1Uawqy+DbufUVjv5Lpb:/u1MokCdfEwfqypkRLZ

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://monster-truck-mx.info/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json	4337	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex	4337	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex	4337	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex	4337	flotin.freeh272.cy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	flotin.freeh272.cy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	flotin.freeh272.cy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	flotin.freeh272.cy

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	flotin.freeh272.cy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	flotin.freeh272.cy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	flotin.freeh272.cy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	flotin.freeh272.cy

flotin.freeh272.cy
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4337
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4364

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
5.2MB

MD5
1d5f03498c4dbe7b67ac3b5f7389bb5f

SHA1
70ed7fbe0a7c1f0d60494b53cec06373b7d2d535

SHA256
d404331794ae327b16b249517d953e1fc79a3fb711e08a7c6fca15e968f26893

SHA512
6f09e7ce0b358eb7dbe433411754c32279d2a0a77eb1dde436063bc636724c5a3540c32c8e65fcc822acbb9e30bf7c978d689cfcf09a46f44334fabafba7e031

Download Submit
/data/data/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
5.2MB

MD5
e3356e851fa19b309543ae4ecae7bf08

SHA1
942787957c6a8fd19ebf6239b2d890585acabc47

SHA256
1ee7551d82349f97d636d868e63db5bf9b802e13a9892f58c38359c15d86a1be

SHA512
278bb1705fd0b6d3d1e4a65f4503f038d8152b5b5fa7a300a519cbe2ce152c8fd898e9b410ee422b96aa763ce5729e05da1e00b9b6c2700be93f34cd11db9c7e

Download Submit
/data/data/flotin.freeh272.cy/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/flotin.freeh272.cy/databases/a-journal

Filesize
512B

MD5
800c93a776cf09eecbbd34a9aaffaad6

SHA1
ab2738a0a6230a470a450cfad245d3e98e415a7d

SHA256
fce928092142d83f0f764794dfcd137b30b4f8bdd1584fdb5cec8e355dd9e11e

SHA512
5ac3bbf65fb738b0f9f84c082cbc2f64b31b64403e44d5b1409e150c51066306d94fd72c1eb1993a5926f5d6c57dd88d8abc93892ef11b93100f14c958a954a4

Download Submit
/data/data/flotin.freeh272.cy/databases/a-wal

Filesize
32KB

MD5
44a89edad8d6784593bcaf8775d3d5c4

SHA1
04c911512225169a3f3738bc29c6923b9d865c04

SHA256
079966f609a610070ac17ce54f9f8f58a42447ed8b906b7ec47194b1ed34811c

SHA512
bad37539b82274e3cd5730b06cc37ec200ed546e2d572520e26bf0cf7d85da97471c7674ea8d82c041e3237dd93c9945dc1eae817bb63a14bfe817bf94859e2f

Download Submit
/data/data/flotin.freeh272.cy/files/flotin.freeh272.cy

Filesize
256B

MD5
a1224940a6b04eab3a813aad063a41c6

SHA1
b0e293e61265f6ee588acff53cd8597976d9ef28

SHA256
a1136e828cf9f8925aee9ce3af32cb80a9ba19c769620b9bf8b83bdeeda2c050

SHA512
7066a98ab36efdff388cdc1ee5fb38240f4d48365f91e83df4375fdf2289ac2dad64df74c32e6c3302783d3b67c65069a8259ad9015609332e10653a815cc2af

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4698088d252d66938188c839fc96bcf1

SHA1
bb22ca262105ca8d0255399276878ba4faf1c6e7

SHA256
f052a07239f09b61ce0edc0c5ac39db8e8976194c586abcba8229408d26e4436

SHA512
3a87a1612944ea0d0acc911c368e40bb4fff4e004030e24433f46ac77b694c6a6ba6a5e708fd2d76ce162d7eaf95759695c3f1512836b7f3479edaf027f34267

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
69fd520d6fc047b1d4b4338450e8cac4

SHA1
1d61e15e4a41e2d3f7fe767fd1ad20016e5e237e

SHA256
5749517200c16b9c94ec131a8e419294dbfa6c789041f6f5843fc6f3312a237d

SHA512
eb39891a98bfe1f95a39a3fb51da816ab069172f81a60a85603d493f52c4e16bb8ff4bb86fcaf65506f332e6fadb5c68581be86f6da6944c2f6931b9cbeccd1e

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
c82b1efdde8c002c7f90ab8bc1ca2b73

SHA1
6f063b404f9e34d161b6f14adca6af0c983af4ae

SHA256
33c8735c9074fcba222ef278476a9a5bd50c8b9ccc1775a5425647661d45a62f

SHA512
2384bdd5aec14a5f90315f6d6ae59ae5140f71a44b08789f37bdf4fc89cc39413b586d710c0481470390dad457f161da97cf9fc9010cc35999de205a5fb43360

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1e0cb86fb7a22ed0a9d4c55c87a3e268

SHA1
aab678a75d112a88d3f3f4d938aa6385349b5b40

SHA256
781a903ff6fbb18d19113e12dc047081d4ee1dd250d79c49775dd8fb38e2ecb2

SHA512
e0f47080cf19f40b599cda1b026dd9452e01de0d3194ce29af612422a83ac6aa7eb76eeee1cadcc833e1b7bec178c87e200cb39f06914e415505190817d3bcc0

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex

Filesize
351KB

MD5
57c3cd19fb542f41b9baaa891246e974

SHA1
4ba134e46f80fa0d0c6d34e50a149161b5cfd1d8

SHA256
9c74cd67633b9470e270c32a04ee6c4ff4f30bc60643804dcfc18d2362bbea78

SHA512
6cd77be465ecbaaf011fcd60b94aff79c59af163981eda1e4a77fba14527d18f69c8782e374be21724b88ff74b207fbb108659085634efe84a7ebcb2af339d14

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex

Filesize
267KB

MD5
39f261833dc209edb38e8bb09c57f22f

SHA1
8146eb5a3202052cb1b97f98620dbb35a2b887e1

SHA256
cb64c9dc99105911c6b6fada0fe718d9fd1110158a6f1d4a3db947243b797f4a

SHA512
8e5dda11ddefe15273a9dbe0ca2b648b0a6ef34011f88e21ae1cacfacc2ef7aa704c64151598cc556468c488cbb069b8db28ab79100f4fa66fe0425d5360097a

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/flotin.freeh272.cy/cache/logs/log.txt

Filesize
83B

MD5
bccc1856a5b931615094d10daefee771

SHA1
72522ebc7686b594abfb3029bb11d6fc9cfc3454

SHA256
e0dd7c3dff016b9ac7fdf306d3e97cbb953fc50a9ff27378510f77386300b269

SHA512
bc2290f0abc64221040df85a99e6b415d8d38dc0e905eee66489594f2b0ffd5d88458efc81e3a2f87dc23536c2778bd2c249f534eb251dd3d7054e5e877b5f8f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads