trickmo | 345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/03/2025, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0.apk
Size

8.9MB
MD5

80d89d1f2000ec6e41ec686e6c2499b7
SHA1

97517bde058bbd3d1a785edc1a55a76573bd8925
SHA256

345e172356ee2b29eb4d9a0f7b6ee7dd726e8795e1dbd245b4be5e2b7796b0f0
SHA512

eafae525d54ca46be783c8398848651c43bd5136f62eb54f50996d149ee1274f6aa6c33b74627733a0af76370b4bf75e8041268c47c9070d090d60c4a07c7e71
SSDEEP

196608:Sjcvj4HDaHNva2kIbcHJcUyOJNy6Uo5Zkajv5LQy:zr4Hutvazc8J9zT5ZnRLQy

Score

10^/10

trickmo banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://b-fulltime.org/u3n6hcu6te3b46gc

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json	4785	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes2.dex	4785	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes3.dex	4785	bakeph.dist292.blog
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes4.dex	4785	bakeph.dist292.blog

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	bakeph.dist292.blog

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	bakeph.dist292.blog

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	bakeph.dist292.blog

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	bakeph.dist292.blog

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	bakeph.dist292.blog

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	bakeph.dist292.blog

bakeph.dist292.blog
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4785

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
4.9MB

MD5
956ec6d809a6e35ddd3155b0a2a93bac

SHA1
560a650bb0055c4d11f008d2aa8c6abde9146987

SHA256
e24376abaa5c9c55a63480ab7c274b9d678abf4a08b9ab83106d43dad05d0d11

SHA512
2ab03b754c3595c537f06268d5043a7311ba2cb272de2533410a5e53c9d234b9316fb2c8ac012ac1e217457bf714dfbcd43ab70d7c88dbf107210a8f5bcf1c42

Download Submit
/data/data/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
4.9MB

MD5
73102177b62492c2a7935c4417376461

SHA1
fa32afcfae2593c05099b15876b567477ee91d7e

SHA256
914f1fc352b3b866fe36e776775484208ff7eef2a20a63e171e82c3c80c68c45

SHA512
a1ecba1e72774fb153e60a5fbf24b86e82c7567256da412d517ac11963c874d9b88f355843d1ac774dc8edad2bdcc9000134244708101b5399edfde52ac25b59

Download Submit
/data/data/bakeph.dist292.blog/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/bakeph.dist292.blog/databases/a

Filesize
20KB

MD5
57baf3e42a94e8dd82e267b2f0619330

SHA1
76512dd29fbaf3cfd2efeae0ac2ab5108b81af19

SHA256
49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c

SHA512
227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690

Download Submit
/data/data/bakeph.dist292.blog/databases/a-journal

Filesize
512B

MD5
afc7cadcfcd3e0d96ecac73f7d88cc08

SHA1
b0f79d9567aae05de6efa36fe230c04268a3ad76

SHA256
6ad265d36ad0e40da2cd9929ee7262b44696f12534d447861a496e9dd0f30c27

SHA512
b850a3f8804520bdea4ae5848191426942f7dfbef66f009ae688c52a0bdccd8787edea1d8a010215402e8d45e987d5e9e1721e423dee7ca6f4e9b967551a8108

Download Submit
/data/data/bakeph.dist292.blog/databases/a-journal

Filesize
8KB

MD5
06c6014b46bae12d7bd53953a7d26e2b

SHA1
e0e382da109bae7dcec34a15534c0cab6cc49c36

SHA256
70dd53f50797e33ad66d1e93292bbc17bbb88e17955db2705c1f7b80596a7bd1

SHA512
3c050e27242a8d8617c74ecf9d712a1b2c37e27e95c01460952a5afae604f81ece3974d2af678e901ac08f9d70dd9ca536c3ee33cfbc4e59cf4feca7ff85c1b0

Download Submit
/data/data/bakeph.dist292.blog/databases/a-journal

Filesize
8KB

MD5
2810c2289be18a7cdc4bed4b2edf570d

SHA1
9346ec756e9d4de83f0ab69e1d93bd13238c5cc0

SHA256
c2055ea691b24efb617ccb9aa68e689ed20b88375b365179f6929f2f56b6782b

SHA512
252148296048608358695692aeca7958f1f2eed4656ed3da632828d5857008f0285e579f3e71cc4aeca4fddfd6e1fc0309ff90b7447e1401d2b4e54cb4ab62b9

Download Submit
/data/data/bakeph.dist292.blog/files/bakeph.dist292.blog

Filesize
256B

MD5
22020ac4cd0c02a4912ab580ef0056ae

SHA1
43c423d78199b52c2a1a33335ef8754d7a2eb613

SHA256
8a9d47d1a7ed7b5eaf894319d210feb162883628e4280585f9db68545fcba5af

SHA512
74cbce56189997a25ebe206a7c42b852248dd0a8b0a040a98245a0687566c7f8372b041e4f0b2f2af7f5d216d5d95388ed9e97ad0a3b94930bfb8ade82964b58

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cabb2101802b586a17b0b8465a7f69fe

SHA1
cc5f5a0cf45d9f4e0ef49c77def607712160deb3

SHA256
235b4726f69e085950cb164c485e009d474ae85dce7e56f1ef4e7292972e3263

SHA512
5e0dcb7742ef6114132f0aa9be9514aa60a75ef92b2cf8caec4c11e664655c21c43efc46b86756253f0f1dfb4d001414f6234344d8e0114f6d79a767cc375b97

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
c373a40b2c4d100ed82891c29e2b975e

SHA1
3941150e53ff5d5db58cabe9526ec38bec8887fb

SHA256
14b82d7a4f07e84dbe8d06c70913ff23f88919263b8ba6bff21a89d017cc21fe

SHA512
4f595300221136fae67532bbe011977aa2abe97f642e445a285db5cc7c7e3659763781f6c23738adff41ae08f7fe53985e19e350908e0a4f77c9d8149dd73966

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6f70a0410e96e981fb866b433d5b2602

SHA1
efe847ec624d6129145765e7946d946001c0a5a0

SHA256
492a0c21e6a1df4393cd8edcf603408be1464c7b6de7ad50c9cce794a539f336

SHA512
d488d1cb7fc59a9ea17657626e04f485a0f830b4325320e81040a89c836e234fa39fab0d2097f0b3bd55d6aef91c4ec1230430c35e1bf60d13d4d45516849fad

Download Submit
/data/data/bakeph.dist292.blog/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
be2c7a368e88312f6a855ae451c37b17

SHA1
3cc2589b8b7eff297698ccbe2fa9d0eb2f468150

SHA256
19b3b40fd6f448b7974c9f6f22c07df3c4f18f4418f5112761992c1b7d81f328

SHA512
a3d6afacb831a7a461f85e3dbda016c60a7e66924e17294770a0012dae6e3bc739d40af63562f26e2b9a4fe2342bc085b784620ea5af6cf2f52b50e6448acdf6

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes2.dex

Filesize
308KB

MD5
f6b89acc1728c7d64be4b042fb787711

SHA1
a1839b0bbfe36db9e1de750895093a41872dee58

SHA256
e38f1a99e3b77b0d416161420651ed11a069de45e9cfae7e41585a3c9ddde806

SHA512
ad74d6dcbea2ee263d451353b773701165d6334dafde8b4254fad369eb544996bbf64d5db2b2423932751fbfd9d7e42faec67dd552384e1d6a00a89c0ecdd7e2

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes3.dex

Filesize
266KB

MD5
53410124d4dbd239d7962deabcce6d8a

SHA1
85f8e02449fdb7eb7a4a7d6f95603c0c381bd135

SHA256
1b5a77a13977c67a4bfe73584e22103aa7656a5750abdb3c7bcc302269b72073

SHA512
59b2796a1d1b7ccc6f7887e4d674d9bfd0cc4c4b851265e7fed0839d754a0058008cd622062c610471e5ff7eab0f269da16a9e0d5d75c19dbbfb16c05bbb4d7b

Download Submit
/data/user/0/bakeph.dist292.blog/app_traffic/MctgTq.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/bakeph.dist292.blog/cache/logs/log.txt

Filesize
83B

MD5
6b50c9439c0ac8e6d0f04421ce8086af

SHA1
cf4e86c995de60225f5370910a5ef3ae54e2d590

SHA256
6df9df646103ac0ba59c7cd689dc119c304da99ad7d09338b0bb32187fcf2132

SHA512
486c69b21225f0d1bcd5cf4b758884ee5016a83a223602478fcb3c41a5017b035e30d36354d8b0aee627150624946c816d31624d96ad6b7a1edac298cd2ac890

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads