Analysis
-
max time kernel
26s -
max time network
29s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
22/03/2025, 00:49
General
-
Target
de2f904d65eba7777a07c589376da441bbfa08ea3b42f66f558f17ef25e52198.apk
-
Size
8.7MB
-
MD5
9b231942e29f923ef4fb97282f0f2f45
-
SHA1
e5a47a7adf82646459dcb07022ff7f8416e90afc
-
SHA256
de2f904d65eba7777a07c589376da441bbfa08ea3b42f66f558f17ef25e52198
-
SHA512
5e9f5319b2efdf65ce5b76858445c910cd6b787694fb6cb5e43f5ea4103f0bb57d9f8f6246fcd99e885e9355773fd54e642253a410b40049ce9b6d0b7223fb15
-
SSDEEP
196608:tZgnrCYktUe6gLshD/xDdhhVKGcME6JI6ynpqOLjv5Ldh:Lgn2d6FD/RXhVL3E4UPHRLD
Malware Config
Extracted
trickmo
http://monster-truck-mx.info/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
orkei.ti981.pay1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b4122e39c8294ee9d31d50d449d63f3b
SHA145b43b7a92109ac0dc68f408c721c324ca083038
SHA256f2ac7eca10fa7bbebc5baeae00dd962326265f56b7a45f346d0731a8b173d8f9
SHA5123d825fbcb80086711030b8f2cc21c9b0b78e9e5c45bb10c9631220e77c1cc41d6c2eff1beac87c12053b92b8175edbc81c1b6c56d96c85293e313bf293f09e22
-
Filesize
5.2MB
MD5d930f180f1870368fbf3ba540d294141
SHA1bc00472d426503389dc544f35c5a319f57d3f638
SHA256e36d07269561bdc7175c07e690d2785c3940bc1627f8ba0e811e32f794575343
SHA5128d9758c1f86cc89d43e0585ed053edd21a2c523d5801f75d7f99cbd503963e418cb9e1eb6cb05de91a7ccd5252405ac17c793406247f575a44d076d1dbed0722
-
Filesize
17KB
MD5d780f836fe54e51872bf31220a4dcb77
SHA15136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae
SHA25632abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17
SHA51262842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635
-
Filesize
512B
MD5532d4d0916dcc2a8d8da07c2ff736892
SHA1e4f3bdcf31424724a4308da1874f5d110cfc204a
SHA256ea7b8b1537058d2112c698095efbdbacc19d7d11fced43b81e625233eada7868
SHA51270663a7ef2ec925285866a5be2c398d09589b4016496d8692fd30f3e1a920f18125efae0323e6570d8ad968d80685f3d3cca8981e7034e1e605ad534750fdfe3
-
Filesize
32KB
MD5fb6a141578bce257fb290374d82e1df4
SHA12c9e050c4bab8fc32398f7238a1475519c074d8e
SHA256a676ad40b3f67d5061945458ceed1988f6e4844593e5e0d4d0fc24ab025c1097
SHA512b8d68122588fcea40de010408f6420d8ac42b8c23170b545400f0b4cfcf964f2dd39d70c87df6934bfe2d8236c67fe159f6de0c9b10cef168b0c6e640b355317
-
Filesize
256B
MD5f3d36bd90ccc2ccbde76fd5b087fffb2
SHA126339a0e2e9f3db16110b46291079f53a187e86e
SHA25628ea0c4c99652092759559e945cd3467f28f6f0991c0833bea2ab731947c3c1b
SHA5129a582c41756258ca81d26f675465674d3b8643bb6d7c719d68d1c31318a56a41b43072d9630e5c829ad86f80255cd0eb096a9fbff1e2e209fbd1854b481beec4
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD534dfb7280ab753790d8ee4eb7ff91589
SHA10cc2f6950682b76c6e47e66907fdcd285235a080
SHA256da7d1ccba050fce592097b4f4bd9ed18aa3ccc38a3f013023ad837f15ad20ada
SHA512603427a8db5b12257fdfe901e27a7e0770862b490c168e0e32121619a412362dc05970523d710e3ed43d8affdf755b303074334f5158dbdf7827392dfb1df59d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5bbbaf846c0431fa1dd9869ea58500617
SHA13c61fab170aa10ad4afc8143176a5c23ee98570d
SHA256d1a3304123bb23d7239670a05247903068b5a4fd72bd9e285230a9e8b8bc917c
SHA5126e23bd7059c9c369fe27de641aac9a94fdaa61121700358a3a835aa6fccbae43d233c07bb45707181c4b4422ea6e846a923c960a6f4c7fa74ad59e8fa4dc0eab
-
Filesize
173KB
MD559b047d9538db70714eadc0b7f432590
SHA1675217077aa9cb0e394b472f8dc670827dba8ae4
SHA25640f0f5bb03d25cb95000a26048c171e730a367e4f8fbd9523ee919708677faad
SHA512f342d7d7d9644c5b1c22858fca8b300791cf1edce681d3376e5e0f75568c2be4c4fae39de2bbea5ff6cdedee18a09614534919121b24f0a655699ddea648708c
-
Filesize
16KB
MD55086ff773d0d8e04e440737ee792c36a
SHA17550850dbd7570ed14350cc3b62ae9dc3a20d2b4
SHA25671362f087eb30a0e8681e3c34f8c94276da4564571299733629e9e78bdc02844
SHA5126a4bd71c96789fb160ef7526acd3e501ea59050223442d38b5f1e797391cc1c9a1fccc05ed03c53ac37ce874e47ad44e2590ed78309e03b5ce08f38d79eca181
-
Filesize
11.1MB
MD528041432b0c51e3e887643272629c83e
SHA1fbea5dfc62f03e1ff784b410ec0d547de0e8156b
SHA25685c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902
SHA5127e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f
-
Filesize
351KB
MD509ca76eaccf11fb9b5769ba60ab9c278
SHA17f0e71a691459dabfac24cf1efcf0e6d04ee2d7b
SHA256e9b22b9dffc776ab692b527cd7a4b0d2cbbdc74ac73e8f40adbdbab6b8e12115
SHA512dd4fef6aecd6330ae1d9926e0549e383758361a05338d0520a29ad69ef4b8c69a1e6142d99adb70d4f8d8341aefb10ee989e83d00d894ddfcff071958450c13b
-
Filesize
265KB
MD50807e30b8ae3f6dc61c13bd56d2c9a03
SHA144f859d7c1d180d658e829d04126a39c48269ee6
SHA2562df538d987437436baf41fadef8a4e17a1ef19f96a002372d001ff7d4ea227ce
SHA5120dc29f85ce95d2eb3e8e9718f01f5b624458c42cca80ea55edc5d9e09410e01491e2f98603e86468fb3a2706bd6b9b100766d78cfc0f968cf4504860db016fd2
-
Filesize
1.9MB
MD52d73c5997273e3910c1ac1d8db7ba145
SHA125737e75ed15863e69d02a14efa781370dfec798
SHA256411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965
SHA5127adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a
-
Filesize
83B
MD5ec4acb8ef10687f55a39ca6f2fe7686f
SHA137822027f2f4a28108a439e1a27b4eb2ca0d448a
SHA256877935f727e86132b16a9a2266ce2b286129a6cebbc3a8ec96550d2d5b308049
SHA512e5becdfdbf02297fb6f3b96bf4ac6148e002d6728d70f71dc0723e17515eca9a5ed08f5935ebabb7b47298a7f3d57287e6aecaaf4f6987bb064ee032410ca03f