Analysis
-
max time kernel
90s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:49
General
-
Target
702d8ae90b3535bf923522cdce541922065fd31c23356474d04c29245ef153ab.apk
-
Size
8.6MB
-
MD5
1e601badb689ec4328e7206483f7fc8f
-
SHA1
d103db4da641e5dad66226087c45a92f5a35ec3d
-
SHA256
702d8ae90b3535bf923522cdce541922065fd31c23356474d04c29245ef153ab
-
SHA512
91b042429caf3ec6709f816d80f95930fdf4bd81965ea7e4232b7d3bdf4560aba64e0e181d5186896dff49137644915381f166835863be2627928882bd77298b
-
SSDEEP
196608:oOsWNIJ8HMmitHQfX1BSNlit0XvuYznJcTZBzhBfCR:/Ps01gNlit0Xv7zGLzh8R
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD56062a6cdd52269b087ea01359d8ffadb
SHA11234ab4afe8f84db845705885caa1ae47060872a
SHA256f675c72b6fc408c95fd6c71e13fd3b650ba3dccc25482eb6514a84401ad0b4b0
SHA5124fa560e886e567e8137ddc99d30426672aad6acec89c7fbd4be2068984483624611662968dee8feb23b6062ff2631de86f961ba921cdd3ba6f7510d528a3842e
-
Filesize
4.9MB
MD544df4ebbf927174833e43c712252f4b3
SHA12a8b7cc64b6ef8303c2edb7666b3eabf816f83a3
SHA2569d98d41bf0c3bc1ad00bfde87d31d81654859436754a531328e7b718dcd2f396
SHA512139e8ef82d16d15e2cc63b76969c16e387c67be8b3808c301e64059da3fe6cb2f8dbe897bfbe1578d83194848289c017ceff86985e2945bf4f41c34c345057d8
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD593e7f88ba7fd4f0152e8e5dc56f1acc0
SHA1f29883585567a32fe4d487e5df14173c39c09e65
SHA256dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c
SHA512be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745
-
Filesize
512B
MD5cb1563fe5d879510c31d296873913b14
SHA155abe806d09926ffa016c91afe6ae4f34acd2470
SHA25627403c613821b382cfa02c1ef00173802608c0f3afe69ff38b8ce9e082663447
SHA512ad775bb60ef1243694c0a3ef3b7e6437c7fc9bcbba38298020d25dbaa823f20206259466938f92fc9f05e43a0a29c9b61148a74b66a9572f788a6f81b396ab1e
-
Filesize
8KB
MD573cb44802637095f09ef41ca61bf40ac
SHA1b62340fefd4d710d512b47fa9ee85072c6609546
SHA25614e7bbcbe01c03a959b56c4cd4772afb34946f4694dd49392d0cdce3405029da
SHA512e97e3ba01567836022f58bda77a89e50f1fbce874043da4df9b5637fc5c55831c55369bdfd62aea9f611a925da4ddb46cde3fde45301eb18860f8aa1c0797da6
-
Filesize
8KB
MD53ea4c7d69a84cd307176f3e4e9401b81
SHA1712c7d03c03eb0d59d236af7cdbacd3cb961f9e6
SHA25657590102d59090920e203ef90dd68a13c349448195b297dd1a2bd183a8c59136
SHA512171cae36e6cd82de26c02052a7d2c8ed6e2c2d83f829c0fc58d0bfc7175966c1078af98c0a37c7416addffbb0d93d1e8a3d53943d87448ac63143bbd39e8c4cc
-
Filesize
256B
MD5c26575b7b67dc4e0a3af6c939a2f31c0
SHA1db5bf1f760d346c8fca41a247ad59568168346ee
SHA256d48330bdebfd7f91ebff52c120b33ac7db32809ede1737a4a5cd8fb0da7a3be4
SHA5126dfb9e14e00d0765f5b34c4e9fbd0a2c22e5cf11ccd24800fbfa0a4cb72a6699981e07c3b5360c1f868fb7844f59c151c7ab97b205671d6bd7299796447a5b64
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD54cd391898f12320b4900ee197e762cb5
SHA1307911faec04432f80f8ec6ae56dbb24c84ea13c
SHA25614f7c0a4f8b0d345179ba3f4bfa2a613e45498f5adb1895f34cbd7dc5ddcd319
SHA51228d00e018b4d9488f26ec37edf5cc7660f9a6f530013f1a18711ffc4eb8d9f84bf4cc5343744c8c380fa2a0779e704a94c9b09f60ba338f04ffc291e316a61f5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD5a52aa5d628b9849384a8e0824c7503a7
SHA158ec82dabf96add051c59f337a9e616f38adf08f
SHA25605b492a87b2653fc62b50b57dd50ee3a9a6101ffe5a47835e4574ad934152576
SHA5128a56b1f67c55b835db7bc7d816bb61da398e31cdf68225e750ea0d73fbce1f6c0af1ba229925b6ee8d622004b0b95aacfd02d60b1a7fd59297074792b02c85b2
-
Filesize
16KB
MD53b823fde3b3cf12281a5d49bf531778a
SHA170bf86d9afcbb50877def0f62de0280f8c7b36eb
SHA256b1818ae13cc09e7b8679fa579bd8582f444288f0ea899d10070e61afb50c0624
SHA512571e94cc729b8bcad1c2cf069dc0d4fc3c65690f5b58847260c45429726a2d5425e7de03eeec33e7b9aa3b5b49f663d1b4f6c26b261fb3378e41c43c38ffbb02
-
Filesize
108KB
MD59d77bde8c19c94da2835ca01851d608c
SHA161a47134e62244a7f6930a2fa1b8081a3b40f2dd
SHA2562d9ce619bd3f3baa98258dcbe05a9a9ac4126358fb32790d6143f341801902ea
SHA512c5cf33dc7fffa90137c94e697953bc31581a7367ce52e64ebea107620298a7adefbbe050cd44dc9fb3588889f0c1a1a59ed8351aef43848175a5306ade832baf
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD58d87968489bc6072858b29457a72f824
SHA11ae8048471095f4b12dab47977d6fd17ad8550bb
SHA2567c276c291d1e977d77d3d50be7b9fdf78eaa707d6888905aecf2f2e4fe3afa7e
SHA51269f5cfac2eef566144873a6d8e902e9232c5853811603b8b718f4fbf8c7da0069c64e4feda3f9bc1e597f989d618c91ecce53f7fc18a7d1f21257b046d96b437