trickmo | e66fc71e6214d06c4f6a927a81dff67832400b96e13db009554fbb76c3a7e8c3

Analysis

max time kernel
7s
max time network
28s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e66fc71e6214d06c4f6a927a81dff67832400b96e13db009554fbb76c3a7e8c3.apk
Size

8.1MB
MD5

39ed4c523ff7821c169ce57c444ba726
SHA1

bad2cba58358b58db890e56116077f28ec55a744
SHA256

e66fc71e6214d06c4f6a927a81dff67832400b96e13db009554fbb76c3a7e8c3
SHA512

6a6f6f2ae61a92fcc6b0e3099e4c489b719974d6b9f5b2bac3c99b920ef8fe04cc0a4701286b0310ef5c775d551c9e81ee90f5a1fc3f9e0d7910b372204e8d64
SSDEEP

196608:kcMcwnozila1aKuENgN0ZdxQx/KnlqEarojri:bMDozia1bjvaW3arojm

Score

10^/10

trickmo banker evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://ultramarketplace.eu/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json	4334	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/wheelsfu.lei842.dac/app_neutral/oat/x86/wl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes2.dex	4334	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/wheelsfu.lei842.dac/app_neutral/oat/x86/wl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes3.dex	4334	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/wheelsfu.lei842.dac/app_neutral/oat/x86/wl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes4.dex	4334	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/wheelsfu.lei842.dac/app_neutral/oat/x86/wl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json	4306	wheelsfu.lei842.dac
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes2.dex	4306	wheelsfu.lei842.dac
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes3.dex	4306	wheelsfu.lei842.dac
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes4.dex	4306	wheelsfu.lei842.dac

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	wheelsfu.lei842.dac

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	wheelsfu.lei842.dac

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	wheelsfu.lei842.dac

wheelsfu.lei842.dac
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4306
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/wheelsfu.lei842.dac/app_neutral/oat/x86/wl.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4334

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/wheelsfu.lei842.dac/app_neutral/wl.json

Filesize
5.2MB

MD5
2fda7227b94ea648be8eac1b6f5b231e

SHA1
36fea9a8d21ba25b8892ac1b44cbd82473ce7b11

SHA256
88922ea3b86716af617087783f3dd53853a51e8670a38837cd15c983a6a859ab

SHA512
40b08732746cd8d8eed45eda3f618b0de659f29a07fa29da67dd400f4ee0baf00b76df109292e12ab75cf1e70662599c00ae575b14d55c2576c0956ace59c112

Download Submit
/data/data/wheelsfu.lei842.dac/app_neutral/wl.json

Filesize
5.2MB

MD5
33135887b3b8a5be270d9d263445d511

SHA1
7acb0203b565c9c50931c6819e3df0ff259335d7

SHA256
bd7d103d34c21f24c2e4a2c8f5e3c9418b9848ed12c0acc7d00a3dd80927de12

SHA512
f96c315cd3ecbed8b52ec7d4ea0f9fa8ed5104cb05e15884634886123a3e156d8ab63f6f577efe6f0fd4f7797f9211ff3befce14617e469fb5446c2f10f897bb

Download Submit
/data/data/wheelsfu.lei842.dac/files/wheelsfu.lei842.dac

Filesize
256B

MD5
8d1ef8a4edcce5348754aedd27a5599c

SHA1
c5616765577d50162ca83bb362dfad924c782962

SHA256
2bf218a255e557fc002460089b52fcefb6dc0e20bee3647be24c662adde3d539

SHA512
0bb331c512a8a64f308295903c6511e6f4d521518d3b08abd631f70f7c900888554670b45e3b3521eace1d576c6e78e54276794a5a299ed2491b28959b8b5568

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c363c292b7baa944dabe3e05e612d676

SHA1
884c444c914e84034b7c6cf2c60654a075219f59

SHA256
210d74890de3ac84f08e897c0b21bc4796ba2cdad7b13d97bb1292b5aaa27b25

SHA512
c6fb36a052c376a8781619cc4eb244c77662f8b40117b6fb33f9943566929e29fc81102bb8deb6a21f8bf2c20270fa286057fa12a4c5808047974499652c4d44

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9d42f58d593a1fbe07a364dcd890acc8

SHA1
96b9b4c38fbd09a099ec3ed24c5ef36912579ffa

SHA256
4f295c83645281e5fb1417f35bfe7a01af68b483f703718f125c2cee9df5a821

SHA512
e791b1d9dc00a18b1a59547fe1341d77297f657a680d76d1f3a8f0e68d74f15e42b711b592e78f2b9cce8c2d764d9c78c7ae45e36777e3534ad8afbd6ce85466

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
0d1d230ced2819e9efdc6c3719d50f5c

SHA1
0578e7d3d9ae592ba874757ebc846e4d6b49553c

SHA256
e0372d8a0326cd5162f6e61af83427354624a32db8c3375a10dca63f5050f661

SHA512
6e7baeb6a8f5e01168f1b4fbf003c3efa4ab82cc8bfb2440d685db9c7ae57b3a6e1c788f102b5601c76513214770635e0da087137d524dd094cd078d0ba96d25

Download Submit
/data/data/wheelsfu.lei842.dac/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
3be66668ce4892a1fca500c25be78071

SHA1
e2c038bd17c483bc91308d221b884bd5e7121191

SHA256
0dc84d711da12f18320002e6db4cf016fc20a35ea6b7fa8c0f0ced1c83739702

SHA512
94a2cccc459155f9d07301e63547bd5dc570cbb51091e2e64cecaf7b96866e61cf4595b2c7d280e65c1c3422d8ff7ac3c2495a43dd5ec0efed1490075d0cf69c

Download Submit
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes2.dex

Filesize
351KB

MD5
363f342e2147f6274c7a5bb4832f766e

SHA1
bfbd1edff46a5e6eabad6f1b5626b2e72a3e4d64

SHA256
248015ba8bab69b2e80f395ba7a5eda2fa361a8b0b70c8567d0101dd100792dc

SHA512
da083f0cf07e6fa6be0927a3b38ef1dfd31aa05eb9950963510d7095047338c0f91cb7ac559416b08314b04a7611c87f4b54e83416d3b32254c6040b51f0ce03

Download Submit
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes3.dex

Filesize
258KB

MD5
1d8438d54441f884dbf04da00f9848c7

SHA1
cf0da73b1bf6e5c1e8691ac1394812f2442efa52

SHA256
f1979778a580bbdcef2dd40b266b87182e87adfdf83839bd551377c587cdda6b

SHA512
3bf487da3977ca39c5b8177b17d78bb2718f9021133b62d126f1c380e9d862bfb3c8f705a3423eb4f263f391de41e2799b4509d343713d703d1c536eadf88614

Download Submit
/data/user/0/wheelsfu.lei842.dac/app_neutral/wl.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads