trickmo | 56a74028bfc73c08da282de29a19d26d0539ea5cee846d6364671fe59e6d99d5

Analysis

max time kernel
29s
max time network
29s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

8.4MB
MD5

6fd72f1bcccd204a9e0f99a72b423657
SHA1

06e4d4fd5d84371150bdc541136c873c081f8559
SHA256

c2925e1433a7f8667540b473c1b7cab2ecce965cf2e8400db81bc740d48f6982
SHA512

4826b304f119b97d7531d35e32efb59af3675b30c093884827d0b8a58f55cdbe14a77c4068a8cca0c8f499d3c3c09c63c519141ab8422fae774c0666daeae286
SSDEEP

196608:iBj5dbmzbVdw7Dteuo8cLlqfhGRN9ibn0CyNJn:0qpdw77LslyGsbTcV

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json	4427	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_candy/oat/x86/bofs.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes2.dex	4427	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_candy/oat/x86/bofs.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes3.dex	4427	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_candy/oat/x86/bofs.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes4.dex	4427	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_candy/oat/x86/bofs.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json	4354	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes2.dex	4354	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes3.dex	4354	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes4.dex	4354	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4354
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_candy/oat/x86/bofs.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4427

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_candy/bofs.json

Filesize
4.9MB

MD5
897919be20d4c434b795378516bc7141

SHA1
30e0205c068150d8e33fd979a80e40c5958badea

SHA256
ac516ae78e961941f3d77731589db90a5ad60a77bb2a589f033eea4e2a2a723c

SHA512
1dc39dc9e86aac180b420b83084d078b6ebcb541b5958ccbea97fa10a5a40af8c41bb49b36633493c9c13372ace0d0ac36d0db8b8a7b92925aa29e7af4e20ac2

Download Submit
/data/data/kegvi.nfec906.cyc/app_candy/bofs.json

Filesize
4.9MB

MD5
44df4ebbf927174833e43c712252f4b3

SHA1
2a8b7cc64b6ef8303c2edb7666b3eabf816f83a3

SHA256
9d98d41bf0c3bc1ad00bfde87d31d81654859436754a531328e7b718dcd2f396

SHA512
139e8ef82d16d15e2cc63b76969c16e387c67be8b3808c301e64059da3fe6cb2f8dbe897bfbe1578d83194848289c017ceff86985e2945bf4f41c34c345057d8

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
c4d968635321b1b8002fed8c65241bae

SHA1
7fa0c57da4d574014cb5c75b8b375b25929a3ff2

SHA256
0adf932cee607d643aefb50441b715a6da2e559678052bd730ba406ec640f957

SHA512
e152219ea28a78c12651899c7a3a6abacf11339b7cea39e79c7a3b2a132aa78e62287e3c2f97ef99f2373aa9f516d4406b4e60293c2ac9387cea9e06e20c8ad6

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-wal

Filesize
32KB

MD5
f35a73816f08d8a0362c3bb71a970a73

SHA1
4f1dedd96231d801aea2795a1df8741e7f66a0fc

SHA256
009c15483692ccb0643acb1ff5842c83a5d844d44462f06b4735903075dce194

SHA512
e633b415372a91f904491f0b1b31e16de8988c376ba0c9054b4fe1c56fe1688c6e6df4fa5955cb4da8c33b38d348d2707ba903ed30ea17b8efe1e2af29a58071

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
2b3ed8f96502bdd92b32b4a51b860b0c

SHA1
4a4676d8126703c90dd010cc6dd8947353cd858d

SHA256
b95907ab40f518288ff5b49c48c60b473cd0ac508dd1ef11869693e77ee05610

SHA512
e4317084504af37cdd7d8021b80a1e1cf5d9e8d6a8a5fc9b61993f589220a6fb8f63869a5ad67af59f349a5a0ffb5320f6811a55688869b6436a76531db8f30d

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
44a5b8676d145081f84041a32d742a76

SHA1
038bee7726196538894f45393db807496d53025b

SHA256
cc26f833f7190df7d75e6d7279c72a919f576996b63bc3c8ec46402f0ced1814

SHA512
0b820836d7b1541678ebba6b38ad84ef170385e185698e71d9b8392f2b76ce0f07460117e5d0b971e75417dd8626b33a1f61ab37dd52b4bbc9ef2c1802e10e22

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1c5a5749f185db94106c63a790757a3e

SHA1
4fb75652960c793856de1a095cbab7803a8f29e9

SHA256
e6aa17eb8669a89fcf47df9c04d3cd27d33680bce336c234acc4e5ff9232f337

SHA512
78af45aaedd51ae94e033fa80e75577cf5137769d7cdb2b2ecb29ed7a02d31f03a204664f8159ca35ecc23b482c5ff1ce4bc7e58cb1aab406810dd9b353d2ed7

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
01a1eab579a69de303cdfa5bb7c73c11

SHA1
5cef8a74251d7448e37f8eb63102066fdd1c67a5

SHA256
91b9f8646ddeeeb02d003ff2eb9dbbc0c77b086e12afcb79510f5967744a2013

SHA512
08a8feb4333884e9383a7fd803bb33531dff8ad2d1609c0d82e79d1750410cfeb59665f0b2e04d122d598e4fb30a7bbe7568b45d3c17728159a1fc66d4708450

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f36091e9980f4f29638507e853d32ee5

SHA1
ff7e4af5e6333c69836aade82a8de0034df93ecc

SHA256
6d7f08a678ed080fdbec4466526f1a4b1ccff8081f3989062a00335a7226914a

SHA512
23ff146b670c03a5c39be6134d2aaa29cb364126629b68463561764fbbaf33dcabfe1b4112a88ef31dd931ecf426f4158917dafdaeeb1e187bf72c837e671863

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_candy/bofs.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
41bb457f96c6ba34f1e6347c86f1d926

SHA1
55f21748e7437519b2ad3217743704b11cba93d4

SHA256
c23f47a0d1af857b14f13a30f35f81bed4120709a3b2635da234ef6352753078

SHA512
e610fce6bfc6ef32fc97d1fab1fed0021516e74a0089063a6b03285b741286ebf2871a7b2a4f7b7ef3b4c31b128b5925893e8bdc77b9390e0c82a563ba74171c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads