Extracted

• • Target

    d4f5730188d3e9bb6ccd428ca36c934e6a83fffb45afd717d9f1d7a2aa866235

  • Size

    11.6MB

  • MD5

    429076ed77ff71d34def00f2a8f8e59d

  • SHA1

    3dc9b3095d33ee27f3abb7883ee061d86f941a94

  • SHA256

    d4f5730188d3e9bb6ccd428ca36c934e6a83fffb45afd717d9f1d7a2aa866235

  • SHA512

    421368282569d882b152b8b70263deaa12ba8f302dbbf040a7350eb0cc35ce405003070ee485de375443dbf917e8a3d8ca82f69214f54c93913914d0c0ad1d46

  • SSDEEP

    196608:gG//dDvCiDORp/LnSZlFAU/dL4QW7nVXx9L2RfoRRgkkwABYYZDkO8xbo0QPbs13:gK9qiDOP/LKlmU1LKBx+fongkkVYwsoG

  Score

  7^/10

  evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3

• • Target

    deper.apk

  • Size

    7.0MB

  • MD5

    36293c4041b160762326ca6a4cb1ac67

  • SHA1

    9caf849114740c2020ba95367cfc7e9588521dff

  • SHA256

    a1729baa1a8e959d01453ab87906b9d6711886a48f04a2d48320320361ef1d95

  • SHA512

    73f8f959f81a37d143f4d889add7c5676e267de93e709b965deb14666c366e39549de9c9d42f6414414a025cf5a5ea36e02737816e72cd291858147f2575478c

  • SSDEEP

    196608:XvCojoIc9v96Dv85B6gkQQ9ceP14W8xf9D:FUIc19cv8j6gkXcIq9D

  Score

  10^/10

  trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

  • TrickMo

    TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.

    trojaninfostealerbankertrickmo

  • Trickmo family

    trickmo

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery
  behavioral4behavioral5behavioral6