trickmo | d4f5730188d3e9bb6ccd428ca36c934e6a83fffb45afd717d9f1d7a2aa866235

Analysis

max time kernel
126s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

7.0MB
MD5

36293c4041b160762326ca6a4cb1ac67
SHA1

9caf849114740c2020ba95367cfc7e9588521dff
SHA256

a1729baa1a8e959d01453ab87906b9d6711886a48f04a2d48320320361ef1d95
SHA512

73f8f959f81a37d143f4d889add7c5676e267de93e709b965deb14666c366e39549de9c9d42f6414414a025cf5a5ea36e02737816e72cd291858147f2575478c
SSDEEP

196608:XvCojoIc9v96Dv85B6gkQQ9ceP14W8xf9D:FUIc19cv8j6gkXcIq9D

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json	4430	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex	4430	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex	4430	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex	4430	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json	4359	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex	4359	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex	4359	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex	4359	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4359
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_venue/oat/x86/EEj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4430

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
4.9MB

MD5
9777db128498ba58dac28af4896a7199

SHA1
00005a4ba363e9a7e36f3bcb20c1e388853fcdbc

SHA256
27330fe29e29b779cfcc585713c4921ae55bdec6ce77a1d4e04f340de1dfc2d1

SHA512
fb7c077b36f69f6195e6e14d60d1a100e283589f119bfb627dc7417d62982b5b240299f365699ec250af3f3440bc44411f559659502ecf9dfd4d2aed07aad94e

Download Submit
/data/data/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
4.9MB

MD5
b2b3075bcdbadfb4908010604f7ad84d

SHA1
73955041895296de3ecae14ed0613e8ddcee5abe

SHA256
46ff52f6360c0325af20f94126ffc1c3d8d72d8965f51b203d8f41541a655568

SHA512
a42a506292899578dda6bb27e8ef50a66519a93b4338312107bfd6f633636935f9414aa7446a9a538dfb1192bad24706cf33f71684827f21a9790803c919a630

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
c6dbe70b346dc6ac3b930140dd87bbf4

SHA1
caac5b95213345c5987e9246f6b25eb18e5ead29

SHA256
052cf679b3f27f80e787efbbbe151968389fae002a1b0ad478341620337da9a2

SHA512
bfab42a7a1a2c5caf94a5fd294edc1e727f6ee1f9ca89f31698b9e2da5f01d340111a810dcb06e78ffee573f50fb6721608d66a43ddfd888f1b1546d5596def7

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-wal

Filesize
32KB

MD5
64707da15f8915b514f4c43cc83949de

SHA1
16ee658da7877a7a6d643cf545b2405a1bbcf0d0

SHA256
2d4c57850dff4d26eff9c5e80e49786196fb47e484115721c4772a983bc52528

SHA512
eb951070d1f0bbc08859fe0de1b1ef3f667724878a5504e643d5421a58d43e7f9265d0e944cb28bf7eb8debf41aa7de2cd2b265d6c47fdd0724bd055c5b8bca9

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
8865a8ae6e347d1bca0e8b97b9a6b21f

SHA1
1bb55ff3a3581333ba67dd06691fe44e022be73e

SHA256
6cf8e700aed80e7795aadb995acfb1ae24d768a587f9287d10de3f58dc851f0d

SHA512
c5b61c105523890eb1b2f93424993dbe5bcc20e5cbf6c4b4fd717dffac8979094f45abcde40c6adaf3f01e24176d59fd413a8dc3422b0ca460ac8fd19ec82694

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d43d5b075a6d9d7e8334578aa8fd0d26

SHA1
219cace90a79ace5f9ec2fcc7c378ea4fa566df7

SHA256
53ff27f1ecbcbabf23134bd175fbc3b0f13e3e59945a6e9193b36bec3891da31

SHA512
9ef36d272e608a6f6423c7165c060d31f1d5cb88329d47073995bcd5d496f011216d3440f7a729bffbfc878b91750be109811ba6fefa29d0be82c86dbfb73d22

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
2ea916c36f3ae5f46095685f635dc19b

SHA1
7085161e5ec653ef03fa22f29a070d4e7b53de1a

SHA256
6888dc2e53f3bb4eb5f75ae074cef380763e3b4ade695db07d221f6b3f19b1e1

SHA512
a00f5f2f7ee1483b431832e1ccf987dc9cb7f0e95c4bd98d20e2e2c7196c3d836fbe547082a91c83c71deefccd94a6e5b7014a4e2ad85ae4f3fd0be60cabda46

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
86186c510bdd06b1e0315d0613195572

SHA1
29cc6ce2f72035b055ec70add3a7fc00ca9a5a3a

SHA256
a37d9977981ba74f1b51bc156c771074b81713e679018f37bd1d10b562ac5426

SHA512
f814f0c38992542ed4ea77bc317e14d7bf02206886103fc364320ab1781466475f43a2d1b15d27e707bff7285643d9827e3ed13833fca8e9d51659fa476d8238

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
298a062556df4944deb29ad879f4facf

SHA1
11df75a5861d0d8d7ad7ad253f89ef85a03ca8ae

SHA256
64ed71182ff0a4f060b1ca62c012cee7b5f527940e48f04513ac7641f1999107

SHA512
928f64e4779f227cc2f20a2ffb092b7321974ae53b5a22936c8e55ffbe2f4126c7f115d1071c8784efb8137e102915f6e7270ad5efa0f6f26fbeb49ca3aadd0b

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_venue/EEj.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
589b63bc8ac30d044d98d35c5d27b4f4

SHA1
267ce7bc4cb479650a7fe78e701c49172966bc79

SHA256
be245ca8c23634bb076d83739c767b293b47816c2e46687a8d01b7ca20ba6256

SHA512
67b5dd2ff9fbda66aa71ccd2e547742668012bb7c4970051c396a59c7e1502a587acfbd6c0030e77a6f943da27e28f7f22d1069ceaa983b175f5dc30e2c2253c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads