Analysis
-
max time kernel
126s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 19:02
General
-
Target
deper.apk
-
Size
7.0MB
-
MD5
36293c4041b160762326ca6a4cb1ac67
-
SHA1
9caf849114740c2020ba95367cfc7e9588521dff
-
SHA256
a1729baa1a8e959d01453ab87906b9d6711886a48f04a2d48320320361ef1d95
-
SHA512
73f8f959f81a37d143f4d889add7c5676e267de93e709b965deb14666c366e39549de9c9d42f6414414a025cf5a5ea36e02737816e72cd291858147f2575478c
-
SSDEEP
196608:XvCojoIc9v96Dv85B6gkQQ9ceP14W8xf9D:FUIc19cv8j6gkXcIq9D
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59777db128498ba58dac28af4896a7199
SHA100005a4ba363e9a7e36f3bcb20c1e388853fcdbc
SHA25627330fe29e29b779cfcc585713c4921ae55bdec6ce77a1d4e04f340de1dfc2d1
SHA512fb7c077b36f69f6195e6e14d60d1a100e283589f119bfb627dc7417d62982b5b240299f365699ec250af3f3440bc44411f559659502ecf9dfd4d2aed07aad94e
-
Filesize
4.9MB
MD5b2b3075bcdbadfb4908010604f7ad84d
SHA173955041895296de3ecae14ed0613e8ddcee5abe
SHA25646ff52f6360c0325af20f94126ffc1c3d8d72d8965f51b203d8f41541a655568
SHA512a42a506292899578dda6bb27e8ef50a66519a93b4338312107bfd6f633636935f9414aa7446a9a538dfb1192bad24706cf33f71684827f21a9790803c919a630
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD5bbad6b4c8c22443b538f87ecbe8395da
SHA1df9f0ad2572728a1d515a1b738f6e76d7bf5fb0a
SHA25601c9ede377d758e276d881e13c75fc2f5d38444a440e78dafe6974e5df08ca5e
SHA512a3f019837b1caf23435b0b8edd9bbfafc42d65d316dd45d1135c78878593abaa1d2ec41fad77e41b66b47967a4ede6cf8caf71ab6422d7ad1fdae92b439f766e
-
Filesize
8KB
MD589d931970d036b7c50b034299da97a5c
SHA1298924a5cb06f4d33297e8a3acc66654b6565271
SHA25648d18dd544b2ada1218f1e198c761abd90d68eaeec4d8867916570d8f640020a
SHA5120c492812e212b86bdcdaa1e52c735999f35d34030376497c7f258ea5b7ff43ee86a3b052b4ea603adf745906cec846597e2f32f100cca474df2a987bf05d0c1d
-
Filesize
8KB
MD51dd9cfe5022fa22fb719948fb8b25f73
SHA188223e376b0666d9d384b50c88b4d12b3396d4a3
SHA2569dfd16a07a0e29db2cbc8570ae8c0165a00d321e4b1b6aec250090d165b6445f
SHA512d5b3a7a246d99362669b19d573eadbeef06ab308dac4f36920d5a9b4f0c52dc7867b87e728d54db03be36eb8a10e2eca703f18b395c04ac64ecacfd36bd5e31c
-
Filesize
256B
MD582f7211a148eb05692188df206d840ed
SHA10d3cac3c616cb80347c61b18246cdad6602cdfa8
SHA256ff4f246eb85e283b70902f95f049eea58325a75661e46199eea78d6ebb14115f
SHA5121db714decdcdc53633c9b76e259e2f386ff03f25d76b1a5411b94c5bec519c52979a171b5300cd85ba137b2e0c3e5c43b23c0f0d00aa8044a179bf527e298e6f
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5c041309f1552075a11e7cab87dcc43ca
SHA1ff48fe4bd92fafdbb5781ac9588b72c29d43e4a0
SHA256a1ae328af5752b64b6d81c105405f5a70068a08583d2bca28610e1a697d362cd
SHA5124a9863ce69f018e04923ab32d2797decd607c97e738fdf93e01e9391069130698bd08fe6fd5bc0cf39ad4134770c0e189c33ece52c29233226c8a09ab525ac31
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD55292db7eaaa99d6a93ad6425e2735b2a
SHA133987080bb3a70e6e1eef6f54f89a965a0aacffc
SHA256190dd7f296545c53ea0b306ad914671a31a4fed2e937b03b575bd73bee08e9ee
SHA512135383ca09e13597aaaf92f0d1c0874d865dd1a4c4b4aa61c2f60a15e4058668242b3cd238839ce53c46e4265695b8489c029ea31c4cddc63bcf82eb25a70c7a
-
Filesize
16KB
MD5fcbc7a82ab949d4af0a0ddbfa13f1ce9
SHA16bc464bb72df8e5a1739c61aecd5de78d6745fac
SHA256dbb2cc6a2796cd7079c27e007e52045cf7175466e8898376be307b902bb760fd
SHA512983ede3c5eaf7aa45a3ee841bb1e169ba770d9fd99d0bd3e13270c19499dd66b0fe597dfd0c490e4e1887d601e07076cc00fd8777809576ee24e52938c10560b
-
Filesize
108KB
MD57402f59719a2d7cce13d68376cc36ba7
SHA154d2d23b715acfb933be99bacf047026952b1bd8
SHA256a1b1a13ae25aaa2855da6b8d62568b243b4f4125674254eaa5e7c3864c2b847c
SHA51272817c7a30c20a0fa95876daffb4f12887b7cb8eec6634083dc2ffa2053b5664ebdd35cfb55aa0f7ca8025169898dc2f87e233b36f676b6d5f84a3ecd308ea32
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5aa4d22c60b859581879c3a6d80ac7d96
SHA13fc95e2e1b4033147664b0db080b05390a165043
SHA256485fe074f540120f85700c21504d4c811d8c82d1c2567ef2c249d59bb41d75b3
SHA51276ddd7a09e39fdaa703e7f53db59829b0bf9de51cd450f815f1470abe550a2ab9553d4b46ac9442ef496621c19e869837b00f7b2a48241821c57e0284d782120