trickmo | 345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0

Analysis

max time kernel
28s
max time network
29s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0.apk
Size

8.9MB
MD5

80d89d1f2000ec6e41ec686e6c2499b7
SHA1

97517bde058bbd3d1a785edc1a55a76573bd8925
SHA256

345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0
SHA512

eafae525d54ca46be783c8398848651c43bd5136f62eb54f50996d149ee1274f6aa6c33b74627733a0af76370b4bf75e8041268c47c9070d090d60c4a07c7e71
SSDEEP

196608:Sjcvj4HDaHNva2kIbcHJcUyOJNy6Uo5Zkajv5LQy:zr4Hutvazc8J9zT5ZnRLQy

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://b-fulltime.org/u3n6hcu6te3b46gc

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json	4369	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/bakeph.dist292.blog/app_traffic/oat/x86/MctgTq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes2.dex	4369	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/bakeph.dist292.blog/app_traffic/oat/x86/MctgTq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes3.dex	4369	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/bakeph.dist292.blog/app_traffic/oat/x86/MctgTq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes4.dex	4369	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/bakeph.dist292.blog/app_traffic/oat/x86/MctgTq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json	4343	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes2.dex	4343	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes3.dex	4343	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes4.dex	4343	bakeph.dist292.blog

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	bakeph.dist292.blog

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	bakeph.dist292.blog

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	bakeph.dist292.blog

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	bakeph.dist292.blog

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	bakeph.dist292.blog

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	bakeph.dist292.blog

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	bakeph.dist292.blog

bakeph.dist292.blog
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4343
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/bakeph.dist292.blog/app_traffic/oat/x86/MctgTq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4369

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
4.9MB

MD5
956ec6d809a6e35ddd3155b0a2a93bac

SHA1
560a650bb0055c4d11f008d2aa8c6abde9146987

SHA256
e24376abaa5c9c55a63480ab7c274b9d678abf4a08b9ab83106d43dad05d0d11

SHA512
2ab03b754c3595c537f06268d5043a7311ba2cb272de2533410a5e53c9d234b9316fb2c8ac012ac1e217457bf714dfbcd43ab70d7c88dbf107210a8f5bcf1c42

Download Submit
/data/data/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
4.9MB

MD5
73102177b62492c2a7935c4417376461

SHA1
fa32afcfae2593c05099b15876b567477ee91d7e

SHA256
914f1fc352b3b866fe36e776775484208ff7eef2a20a63e171e82c3c80c68c45

SHA512
a1ecba1e72774fb153e60a5fbf24b86e82c7567256da412d517ac11963c874d9b88f355843d1ac774dc8edad2bdcc9000134244708101b5399edfde52ac25b59

Download Submit
/data/data/bakeph.dist292.blog/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/bakeph.dist292.blog/databases/a-journal

Filesize
512B

MD5
d30caecdbc9fa637cffda6800b205d45

SHA1
a77c5632e099ab03f5d5d8f111cce48ac88b2937

SHA256
720a05a5a84605cfa0e4adaed9b4ea0448751a6287014d0cced2576d6036b9be

SHA512
d7df2f82b0021cfd20d68b781f65212daab1d4c24917222da1c54f48f07edb97064ea82b768fe104fb2639b16095c9ce30aecefe5e9e98ce798f5492b6feee04

Download Submit
/data/data/bakeph.dist292.blog/databases/a-wal

Filesize
32KB

MD5
9e14955caec19f6c61978e3256e8c490

SHA1
fa1090bf6cf360d6492dc74591012aa7b796bb68

SHA256
531135da26f434bc59ca1c33821ff27b858b5f94b598957355bba90ff051d01a

SHA512
6a42d9c59908a7ae53f645b36c2899ccb30abaaba862e82a133905d7648c8ea22c80976dc850007d332eeff7c15bac2b0a7ecee76018c72eecd8814472c6b716

Download Submit
/data/data/bakeph.dist292.blog/files/bakeph.dist292.blog

Filesize
256B

MD5
c3d6c6e255679eee467da3f144f4b8da

SHA1
7de3c63a37bdac73c40018f0239a97bd11979455

SHA256
9cd39a7b82c51bb3e6b03a3dc9da60f1f1fb2129eaee400dc67a4e0aa9755541

SHA512
5470781645b23b85423c65dfcb2d0b5f803d0bb2e4e5697241f7dc9628600a858315702b7b5503b1069e1f05140f4d50e6699209861be54202ddffb851aaace5

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e0b3c5b2d5f47243d9dd4c1b98c0c173

SHA1
ffec8d3ec6703ea2eaf5cceea6b2f43e9ae9b213

SHA256
c46ac8b74716156a5798a5f4c0b6b967d98f8540ff4b1170628b6d776c33e05b

SHA512
4ccec2ce7701676d0a8618d8763f2484ab70e6b52d42de6d09751d20ab362a9acd5d3b9dd487a7b2a74cfdd67482c3e5f9399a1ac9b052dad8201df5309c174e

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
27e16008dc24e7b2923c246ec73fb34e

SHA1
0ff350fcd6107fd370a7cce9b2086cdeb3f26202

SHA256
d22a768108951deb3cba89c77bf72cc2025a30b5882127af27a41ae6cfcaa93a

SHA512
fe7a1b86f314792b715341ac7b71b839c8fd3a81a76e4f566c2222dbde5f804840fb874312ce36adb5db0f630099b2cbfe3b889d034809b30bfd0500351259dd

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ed53d1c325944b04ddb4dece59b44c4a

SHA1
32b29806ec7288079b84d135568dadfa1b8f3fab

SHA256
0b82c0eff4205a7396b86b897da728f9a906be7107d10b157c757b198a56c5e7

SHA512
1cef4588f83414e96957bee5f554c8dcb5b538a454e15023aebafa26eb312367a3a10ff651b6eed4aa581ea305fc5b82bd9ff3eb61f66bb39925060aff7a34b4

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2ad7804a5950d3fb08a161fd07310813

SHA1
4ef468e92df8f604794455b70cd05369cb5dcf07

SHA256
8b6b3cfde94a30b41187a5975eff9e0ce570e451fc7a1675909e7a469da26bec

SHA512
87299dd7fb05eea03d8a94dd2cb028acff889aecbbebf2878d320b698f8c8e4dc0e59d25d224ad39983c534c99b1d709843e608ad1aaaf4f6d58918e2d4c48f6

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes2.dex

Filesize
308KB

MD5
f6b89acc1728c7d64be4b042fb787711

SHA1
a1839b0bbfe36db9e1de750895093a41872dee58

SHA256
e38f1a99e3b77b0d416161420651ed11a069de45e9cfae7e41585a3c9ddde806

SHA512
ad74d6dcbea2ee263d451353b773701165d6334dafde8b4254fad369eb544996bbf64d5db2b2423932751fbfd9d7e42faec67dd552384e1d6a00a89c0ecdd7e2

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes3.dex

Filesize
266KB

MD5
53410124d4dbd239d7962deabcce6d8a

SHA1
85f8e02449fdb7eb7a4a7d6f95603c0c381bd135

SHA256
1b5a77a13977c67a4bfe73584e22103aa7656a5750abdb3c7bcc302269b72073

SHA512
59b2796a1d1b7ccc6f7887e4d674d9bfd0cc4c4b851265e7fed0839d754a0058008cd622062c610471e5ff7eab0f269da16a9e0d5d75c19dbbfb16c05bbb4d7b

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/bakeph.dist292.blog/cache/logs/log.txt

Filesize
83B

MD5
976caae2ad018c3d7724578e6c72a18a

SHA1
73717addb909eeeccdd9c125e4e2143b5591513a

SHA256
9a77732de847ec3ca0d99fc63ea8cb90fe50ed4a2b4edacd7dfcda7836280dd5

SHA512
418d9498de39a8f47464d93d653942df76dc6c4234e55717c353d5780cffc50bf511bf9e02a4c77fed661720db6eb57aee2989c6cc4cd99e12db00b208d715da

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads