trickmo | d92c8fd829d80c9b0700fd077957d8a00ff17064b001d147233b971aea0e442f

Analysis

max time kernel
92s
max time network
149s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d92c8fd829d80c9b0700fd077957d8a00ff17064b001d147233b971aea0e442f.apk
Size

8.8MB
MD5

b8749ed305053ea52cb866fd6dd7444c
SHA1

cd9931622abdaca64ee70021965606a199c2bc12
SHA256

d92c8fd829d80c9b0700fd077957d8a00ff17064b001d147233b971aea0e442f
SHA512

6d2dc1cde0dd94ed4ce4abef7334f5e703559a6d2749bbed2cfa264c4b6a5cad45716fcad47f506777f3e73c6dfd23c9d538e607b4012e46227d29362935e5bc
SSDEEP

196608:JbUoY2S7vhEYoQRl90WGQ647qfsrLgbO6JL1gf408gBArrX/s0WbhJ:JbUoYvhN90LH47qUaL1g5tAXPFWbP

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json	4368	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes2.dex	4368	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes3.dex	4368	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes4.dex	4368	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json	4342	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes2.dex	4342	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes3.dex	4342	kegvi.nfec906.cyc
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes4.dex	4342	kegvi.nfec906.cyc

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kegvi.nfec906.cyc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kegvi.nfec906.cyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	kegvi.nfec906.cyc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	kegvi.nfec906.cyc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kegvi.nfec906.cyc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kegvi.nfec906.cyc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kegvi.nfec906.cyc

kegvi.nfec906.cyc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4342
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/kegvi.nfec906.cyc/app_issue/oat/x86/uOtWWFa.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4368

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kegvi.nfec906.cyc/app_issue/uOtWWFa.json

Filesize
4.9MB

MD5
3e8400a08084ec943082a6246f7dd421

SHA1
690fdfbceacf7fcdb56d16ec6af727d98460518e

SHA256
f12d935dee605f160e2b1df9686b55d651b0ef8f86aaf4ae61e3907768ec0556

SHA512
05fe6ca0c0f7f7f9bcb1bda5668e19a522e5415098a337b2d3d1de400a90eaadf036c827d085f62b74a03a8fa5c907ddf2ec922589ac72bb6d5469bc0ecd24b4

Download Submit
/data/data/kegvi.nfec906.cyc/app_issue/uOtWWFa.json

Filesize
4.9MB

MD5
f0b0515dc0a5a55f5cd9bc40cf195ac5

SHA1
27e15c3fefd383c14d390c800c56dd749960f8c3

SHA256
53b58627764de1e0acb24cf5b377b66903aabc04cdbe1485c9ca66b319439b37

SHA512
db36b180f24d421894ac9bf250d97ed56d2105e97ade8eff9892a8f35ee7fab0ff010699eac579717a82ce23899fc119ed5a25c11f9d328061fcaca223ef11a6

Download Submit
/data/data/kegvi.nfec906.cyc/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-journal

Filesize
512B

MD5
ca5e86fbb3b0fab8dda862016045a6e0

SHA1
f6035da6d314825b0ff79b73a3cdf433b1b3f870

SHA256
b7ce1e5215de7ea35b35542bf6de67a49fc0dc97515cb2ce7ce955e0273953c8

SHA512
1507353d83f63011aeec330a11b9d92665f7009fb64170f415e12f64e6626ac2296995ebf4697d7a1f6dde862b9a9ace75829180d1a6761ba22676ea217781a9

Download Submit
/data/data/kegvi.nfec906.cyc/databases/a-wal

Filesize
32KB

MD5
1f7bfa7e30ab8c42607f4744bd3eaf38

SHA1
c23637a5d0fab7978529227cba057d5137f3f80c

SHA256
8746e38712b2037a58dd54deebbefd5b87c64fe25c111e4c839cf5856f5a57ac

SHA512
801ba2e2066fd15595a1b7df7b92086c2aa65b1e7a408c10f69de18d1e950fefbf63dbfda17d5d49c7fac7af6a751079e952da488f61d5f15a15a6a88024c03f

Download Submit
/data/data/kegvi.nfec906.cyc/files/kegvi.nfec906.cyc

Filesize
256B

MD5
51a47e28edbe6ec8593c2e078708bce2

SHA1
6a598fa169ecb4f66408f133e2478062ec0add8c

SHA256
6f0b1a6a4d07198a9dbb5fc107256b0a7379f2c9c51c2c76f940e983763c48bc

SHA512
bbec3e524bb20a7bfe371e91dba543a1ba77ad842df7c64d825c4ba1867f658bdb1be701057d68fa03e875795f474c2dfb6a52783c272cdb1126b57cb5b289d6

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
fb7e13525878eedbdeb5c08f2e97e342

SHA1
eaee20802a1266ac22d7c58a171baa35b3b68b21

SHA256
5ee5b33b5916cd506527a25697afa0858e68b82d5167516d41344dd15dd40ce0

SHA512
bb5716d45368b018f50ed23c629da3dd98962cf1d930bc26da0b7d79ef7feb188df2d23acfa02079a3c705108b4aa693c1c640fd28b5832dd403594024fbe153

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b0256bfa9fdc12e5fe4299cfd86988d7

SHA1
fa000e73fa6de417c82d66179f2b3d2b08a98139

SHA256
25f92aad18aaed6be1b02ddd89643abee17e705c53cc81f24b45da2f10f46f68

SHA512
eb76b5d9cb7361a291b595369c1304911246acae786f6772c8f66c3117d9aaa89ba3dc66cb7c37e3f684f3c34c86d0baede0ed45f2280733638ec9e869526704

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
8e60e890d9fbb5f238c97edbaaf605cf

SHA1
2e9f8731b07df3a8a3816ec19ba477bcfa253a02

SHA256
0cf58855733dff0c55039bf8dd9d4c0f917ae60deb92a8251fc1ffd64663cd45

SHA512
3d13e20cd00ac21ff5b72e2ea30a07830e21747d5ce0be9d108923c3a55841fd978186ace403515c9a7a22395f36eac723112bd9bdea524c8bcaab8e23d23ffe

Download Submit
/data/data/kegvi.nfec906.cyc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
8da2abcd4dc6b4fe77043c0233288f93

SHA1
6f06f44dada80a812effdcb054612bf5dde3126c

SHA256
1aab97929951f6e0ae7d4d0d2be0aac682a67055e569ee0b195563764af49f7d

SHA512
c5e4766159f71521d53de4b3d2edb4b78eaa6b33eb9035f88b4a08d8772c58ffb2d5f82abc24fe390f882d3c0ebf414481f02b0bfa12217ebe48362406076696

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes2.dex

Filesize
308KB

MD5
c4f1bf1c779a21a25c3dbf5a15efedc5

SHA1
e525c2e12234f6eca7690f2bf0e29ae48f958e33

SHA256
410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd

SHA512
ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes3.dex

Filesize
265KB

MD5
c6abf8a6dbc7699cb23c034ae965fb05

SHA1
1a420d700e47d712acc84641fad51a4b40041cfe

SHA256
c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958

SHA512
9061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287

Download Submit
/data/user/0/kegvi.nfec906.cyc/app_issue/uOtWWFa.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/kegvi.nfec906.cyc/cache/logs/log.txt

Filesize
83B

MD5
ea2ee7acbb3966a407f69efdf7a6bf57

SHA1
53c621835f550884a98e4b471d5f01e624b4c45f

SHA256
4a3f810f6271dacb76cc18440b7727b8fea13efe46627d008d99d861b543fc9a

SHA512
1b62664d974aee6f62adf45fc1f1f3dfc7c5f11fe0c895a36140b86133d21c65771dadfc52f58549d5b61224622cdd4650fe4118458ec0b311d0030a956faea4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads