trickmo | d4f5730188d3e9bb6ccd428ca36c934e6a83fffb45afd717d9f1d7a2aa866235

Analysis

max time kernel
29s
max time network
24s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.0MB
MD5

36293c4041b160762326ca6a4cb1ac67
SHA1

9caf849114740c2020ba95367cfc7e9588521dff
SHA256

a1729baa1a8e959d01453ab87906b9d6711886a48f04a2d48320320361ef1d95
SHA512

73f8f959f81a37d143f4d889add7c5676e267de93e709b965deb14666c366e39549de9c9d42f6414414a025cf5a5ea36e02737816e72cd291858147f2575478c
SSDEEP

196608:XvCojoIc9v96Dv85B6gkQQ9ceP14W8xf9D:FUIc19cv8j6gkXcIq9D

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex	4331	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json	4304	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex	4304	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex	4304	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex	4304	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4304
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
4.9MB

MD5
9777db128498ba58dac28af4896a7199

SHA1
00005a4ba363e9a7e36f3bcb20c1e388853fcdbc

SHA256
27330fe29e29b779cfcc585713c4921ae55bdec6ce77a1d4e04f340de1dfc2d1

SHA512
fb7c077b36f69f6195e6e14d60d1a100e283589f119bfb627dc7417d62982b5b240299f365699ec250af3f3440bc44411f559659502ecf9dfd4d2aed07aad94e

Download Submit
/data/data/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
4.9MB

MD5
b2b3075bcdbadfb4908010604f7ad84d

SHA1
73955041895296de3ecae14ed0613e8ddcee5abe

SHA256
46ff52f6360c0325af20f94126ffc1c3d8d72d8965f51b203d8f41541a655568

SHA512
a42a506292899578dda6bb27e8ef50a66519a93b4338312107bfd6f633636935f9414aa7446a9a538dfb1192bad24706cf33f71684827f21a9790803c919a630

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
ca1ee848c29f3e60a91c42b917ffb74c

SHA1
a355d91b1d503c71b99c4b7048ffd382259eb394

SHA256
45ede54db2e8ac5a4cbb7a38fb403686d40907230ad3f1eb4f02be5265fce633

SHA512
a9cc0ec5d118690585f5185ad69520a5a68dcaaa8c88dba23dd5ad0af224db71e16190e79c1e52b70d78add75c60a9118e3e9ff979998723c9b77ce3b00cdf38

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-wal

Filesize
32KB

MD5
91fb946f6b7c88f2828753c095f8f2f5

SHA1
a42431f8c0e3dc204b79fecc69c0a4b6919506a2

SHA256
6cf27f078affc0cfa7c8dd2728cb94d79197e26a7061c3f6f6deed5b7f4205fb

SHA512
055b0c01f42a7e4b5071e6cbfcb73c084ae10238e1c892637beb5448242e29f3aca28ba914220347bc70119beb5c8c549c0ffa064f4028544204ce5189936b8a

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
569859928ecfe6d75a9a3c3dfcf36169

SHA1
48135e78be67f587842c261bff627c05a6b5d4d3

SHA256
e961bbb4356ce283923ff21e256d6e988068de9aef81038b2d325e97ccf909e7

SHA512
1d7e9d8b1babc8881661f5c51e95002b629295cd26a71e85d52492d0e592b2812f4fd4cf0408991e4cfe4a49c70fe777bef2a8fcd229259af9de9b388b2ef624

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ead7310618c0395415f6aff1f5cdd1ba

SHA1
dd33577e304b9278cb227b191f86d4c319ae647b

SHA256
945170501efd551568e538f2c9cd9578303a407aba141eac3f485cc8eeffc9bf

SHA512
e56218a42fcf42113c695e1f7cac8a163bd177f86b893aac4c5484ba2d6fac97b0e1a2e904aacef8cdf833662611391a345cad5f1206e3c036e99454ac9c177e

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
822c629d1c6fa83c1184101fc6137331

SHA1
da7dfaa71c49fa7714de784a99f471c1687b5730

SHA256
fbb2eade54a64eaaca8af156e5c07f68ae315fab5c789099e011a70407b1da49

SHA512
eef8f50edd5913b86eaa0874e3bddefe8bf0c2c849d168595a9ea6970115b73de12e107b0edf56c485b20d4c98699fa31702263be3bbc823b72df56451809529

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6795db38882ff6374f768fad73a1c4f2

SHA1
6ad44e0f3cf00909c41cc8c4de784c8f03f59b54

SHA256
780314424e0053c0ee70107c24ca24e23688ab7e8fd7872c3a23f75bb81eed73

SHA512
87ba80e25e1dc89674fe2dabb93b3197ea7b20f7269377c5250edec2a4ad5de0686ed73b9fd27c8447e5a34c1295c4122975e72b770d12a9d3747a525b9cb390

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
76824d18a212ed2e55410717279903e8

SHA1
02c1185dcfae553da3739241678472c95801f7b8

SHA256
5c8272eafba5c9d0b9b21b4c0e1fe594f79f7a60b4a5c6a232cb7b5690a45247

SHA512
80382ef463f5c9d036ee32c7bca7ab68e6cb0150d5f014055531f3585aa4997be3140250fc49db7a39afc5d66109b3483fbc52b102c8cabf2c4c0e98a2c6d8c5

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
6b167861c6b101a8989e790b57071bc4

SHA1
e09a4767a04589f94176db83cebc368b38873c1b

SHA256
b9e2fc9b2d917855a43ed4257f775e6a604872e9950f1278ac6d71cc52b74454

SHA512
69dc17ab4e36b7fe71a83173d4caed4c19f9b65528d67eeabd1322f138863aadcf0606351ad1f45f9aa192925d19b6c7163c67b35cce9f4662ad787a28fd1460

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads