trickmo | ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048 | Triage

Sharing

General

Target

ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048
Size

7.1MB
Sample

250322-addf4sxnt4
MD5

4db4d4e3debd26c9e7fdd841bbc1ecf5
SHA1

aeefacd157edeb48cc614ffc07d17089c3c9b3b8
SHA256

ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048
SHA512

fe75702aa070a54126f92f3f2dd5e3c5a8d0b4a8c44e6b958b9e958978d3d3d9dcb001db8ecfdad8db8a0638344152d2685665cd9b2cdea43c0faee33ce55653
SSDEEP

98304:zuPfGhHxNIcEIjxZEloYr4lPcxbKLBOro1g09mBsF7hzhPjJ3lrmFagKHJBb6U9S:SGFIWTplnoFBsFtR19mEgKj+p

Score

10^/10

trickmo android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

C2

http://mikejprdanorg.com/c

Targets

- Target
  
  ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048
- Size
  
  7.1MB
- MD5
  
  4db4d4e3debd26c9e7fdd841bbc1ecf5
- SHA1
  
  aeefacd157edeb48cc614ffc07d17089c3c9b3b8
- SHA256
  
  ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048
- SHA512
  
  fe75702aa070a54126f92f3f2dd5e3c5a8d0b4a8c44e6b958b9e958978d3d3d9dcb001db8ecfdad8db8a0638344152d2685665cd9b2cdea43c0faee33ce55653
- SSDEEP
  
  98304:zuPfGhHxNIcEIjxZEloYr4lPcxbKLBOro1g09mBsF7hzhPjJ3lrmFagKHJBb6U9S:SGFIWTplnoFBsFtR19mEgKj+p
Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Input Injection

Tasks

static1

behavioral1

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

behavioral2

trickmobankercollectioncredential_accessdefense_evasionevasionexecutionimpactinfostealerpersistencetrojan