trickmo | 9e5da5bf917acd4132c8b3d4b63af9b23d7bc16e71e51bffcd4a82162e598394

Analysis

max time kernel
124s
max time network
149s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.6MB
MD5

3be791e432b3ef50c0c947968afb41b1
SHA1

6aecf3056085a44d709879f726b36447ee9f5610
SHA256

6c968e052fdb59730897cc37a0e61e69a8c5a20f04400c0276534ae0604c430d
SHA512

9def8ad356092a24e936c735b9fb3122a7dfa559c5b2ba2ac8e92428accf4bfadff77c51e893acb917fc6b758de99986c66bd90d8135d5ac89e99e1dd5d952b6
SSDEEP

196608:xtK7pfMaBf8C4GfJCtMJCp1Uawqy+DbufUVjv5Lpb:/u1MokCdfEwfqypkRLZ

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://monster-truck-mx.info/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json	4371	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex	4371	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex	4371	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex	4371	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json	4346	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex	4346	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex	4346	flotin.freeh272.cy
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex	4346	flotin.freeh272.cy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	flotin.freeh272.cy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	flotin.freeh272.cy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	flotin.freeh272.cy

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	flotin.freeh272.cy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	flotin.freeh272.cy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	flotin.freeh272.cy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	flotin.freeh272.cy

flotin.freeh272.cy
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4346
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/flotin.freeh272.cy/app_avoid/oat/x86/QjGX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4371

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
5.2MB

MD5
1d5f03498c4dbe7b67ac3b5f7389bb5f

SHA1
70ed7fbe0a7c1f0d60494b53cec06373b7d2d535

SHA256
d404331794ae327b16b249517d953e1fc79a3fb711e08a7c6fca15e968f26893

SHA512
6f09e7ce0b358eb7dbe433411754c32279d2a0a77eb1dde436063bc636724c5a3540c32c8e65fcc822acbb9e30bf7c978d689cfcf09a46f44334fabafba7e031

Download Submit
/data/data/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
5.2MB

MD5
e3356e851fa19b309543ae4ecae7bf08

SHA1
942787957c6a8fd19ebf6239b2d890585acabc47

SHA256
1ee7551d82349f97d636d868e63db5bf9b802e13a9892f58c38359c15d86a1be

SHA512
278bb1705fd0b6d3d1e4a65f4503f038d8152b5b5fa7a300a519cbe2ce152c8fd898e9b410ee422b96aa763ce5729e05da1e00b9b6c2700be93f34cd11db9c7e

Download Submit
/data/data/flotin.freeh272.cy/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/flotin.freeh272.cy/databases/a-journal

Filesize
512B

MD5
d055ba1c2316aca28149eacd921cfbe4

SHA1
8b3c2eed225430be8f1677781c47513d426a06d5

SHA256
0c51877be7e6c5a1ff08884d9c8a0a0ac3f57f0c74c49ccd100936155271bdc2

SHA512
5f0bae19ac4dac7567e0dccc9c976186880dedc2403a6d23cfb860324c6eccf241e0130e92d445e18e5b5ca0aea62154ae68b90ee7eb1d57b628215caecf831a

Download Submit
/data/data/flotin.freeh272.cy/databases/a-wal

Filesize
32KB

MD5
10560c5080e8edd9c80ae988107bdb0a

SHA1
11cf5fcf4e2ece8c3cae608e7952f24653084b54

SHA256
e289b39b2350bfba454a61b9a36cb08dcf7d9b5b085f31e330f8a73d1716e48b

SHA512
5c6f655a93cb15bbf73b26eb2e9a4748be71511a83e91aa9433e187077ee15415a071d133dd3a212c540e191b23f3fa5be467466788a93c37880ab0bfb59cf29

Download Submit
/data/data/flotin.freeh272.cy/files/flotin.freeh272.cy

Filesize
256B

MD5
8a6563b7e0a66e37fb4fe099001517ed

SHA1
5b84137057e2c711805c7dc1a51687554e937e50

SHA256
f19ecef184f91ebc4e5098e28928d12eb19e015963de0f9f6200a889a17fd501

SHA512
5ebf68a9324b40a1f0a983e9a4b583dedf11705dbac3c7341a7d1ed83137826e8c705c64f0cbe81295872a6fdca294205cd036ea802bbe85149e8bd39135c12d

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cddd0e2830a164dfa37a66c9efa5550c

SHA1
98111a6d415c22d8efacdb3342c75ce14bfd2e7d

SHA256
f4546a5cd472a0b49f99407c5db2f8e4b05689f4e8b703912c8131e65b9a26df

SHA512
218d89d240686f29833b5b912b4ceb63a92787c2bdfb14c1e56851e42ed841313bc2d015eba10e59ea0d7f8e8d74d947933597e75376af32c3019dbae74aedf8

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f43a70b1e6affd17dcde06555c310ecd

SHA1
308a07183e0cc5d34474a6bc64900c83086d694c

SHA256
2b57efec3471f6e1b28603c6d032e1ac744e3fb6c5cbb7fe8d9389dfe7efe924

SHA512
b1b81a96d0dfc1b1b8ff6c69921ed81e06d9d58a6a5c6eb00f011074ce7b6984314ec70ec867d0d57601a1d4b33a6ccf8f645b64e99c29e72abeb96eec9bda9b

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
8110c02b0606104dca2316dbdc638307

SHA1
82a99aa8aa516b09fb9005b2dcb50adb21e3938d

SHA256
2c587b0e0a30b763b3037bef867fb6fa14dba74aa9e222f1b03ae661942d3955

SHA512
4b317efd2fd19235f301fb66f61b4167655b3eb9910a413695fe64359571ddb2725acf6053605ae77a3391a8e390f71d5814b4605c710689ce5ea1e444d2733c

Download Submit
/data/data/flotin.freeh272.cy/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
8180b51480e8a98894fbfa2fc4a06469

SHA1
227cb8e856bc8a32405340f8b0532af94876751b

SHA256
aa4b8d4634ec97f784f9bdd2571283d0b369187cae2b1da3621bcdfdd1d94833

SHA512
72c2e3680b060a0ec1d8bc757f5a1496baf9d8c6bcdf2cd2f250d4243f8440c37735ac31f5e32ef96588e1dbbc14f8fad92d5e80a2d0cf7c51fa38f57fc0f233

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes2.dex

Filesize
351KB

MD5
57c3cd19fb542f41b9baaa891246e974

SHA1
4ba134e46f80fa0d0c6d34e50a149161b5cfd1d8

SHA256
9c74cd67633b9470e270c32a04ee6c4ff4f30bc60643804dcfc18d2362bbea78

SHA512
6cd77be465ecbaaf011fcd60b94aff79c59af163981eda1e4a77fba14527d18f69c8782e374be21724b88ff74b207fbb108659085634efe84a7ebcb2af339d14

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes3.dex

Filesize
267KB

MD5
39f261833dc209edb38e8bb09c57f22f

SHA1
8146eb5a3202052cb1b97f98620dbb35a2b887e1

SHA256
cb64c9dc99105911c6b6fada0fe718d9fd1110158a6f1d4a3db947243b797f4a

SHA512
8e5dda11ddefe15273a9dbe0ca2b648b0a6ef34011f88e21ae1cacfacc2ef7aa704c64151598cc556468c488cbb069b8db28ab79100f4fa66fe0425d5360097a

Download Submit
/data/user/0/flotin.freeh272.cy/app_avoid/QjGX.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/flotin.freeh272.cy/cache/logs/log.txt

Filesize
83B

MD5
35a6a20a67b4630c9ec4e175462a64e7

SHA1
d3d3df91c59c282ec911074c08eb9a7e566874a3

SHA256
bf3f72ce948ecf53fbefce4d26e565c5550002531ea053c0b9b1ae5ec4186695

SHA512
a91c0ccc5ad7a3fb8d176a25cddeac25cf4a9946defcd0f5bb30385cfdacefb24f0a9fca5924d0ad9bb7352417fb28071a26687aeebb0dd05b27987e09c0be24

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads