trickmo | ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048

Analysis

max time kernel
131s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048.apk
Size

7.1MB
MD5

4db4d4e3debd26c9e7fdd841bbc1ecf5
SHA1

aeefacd157edeb48cc614ffc07d17089c3c9b3b8
SHA256

ec59004e19643019010888d239e3a0ea916788d6cafdd71392089d0b988c3048
SHA512

fe75702aa070a54126f92f3f2dd5e3c5a8d0b4a8c44e6b958b9e958978d3d3d9dcb001db8ecfdad8db8a0638344152d2685665cd9b2cdea43c0faee33ce55653
SSDEEP

98304:zuPfGhHxNIcEIjxZEloYr4lPcxbKLBOro1g09mBsF7hzhPjJ3lrmFagKHJBb6U9S:SGFIWTplnoFBsFtR19mEgKj+p

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://mikejprdanorg.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json	4326	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/butttots.plum676.sai/app_wedding/oat/x86/jdgnHyW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes2.dex	4326	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/butttots.plum676.sai/app_wedding/oat/x86/jdgnHyW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes3.dex	4326	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/butttots.plum676.sai/app_wedding/oat/x86/jdgnHyW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes4.dex	4326	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/butttots.plum676.sai/app_wedding/oat/x86/jdgnHyW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json	4300	butttots.plum676.sai
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes2.dex	4300	butttots.plum676.sai
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes3.dex	4300	butttots.plum676.sai
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes4.dex	4300	butttots.plum676.sai

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	butttots.plum676.sai

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	butttots.plum676.sai

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	butttots.plum676.sai

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	butttots.plum676.sai

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	butttots.plum676.sai

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	butttots.plum676.sai

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	butttots.plum676.sai

butttots.plum676.sai
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4300
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/butttots.plum676.sai/app_wedding/oat/x86/jdgnHyW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4326

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/butttots.plum676.sai/app_wedding/jdgnHyW.json

Filesize
4.9MB

MD5
9bc28fa2f41c876f1ba4a481a0c4fb58

SHA1
4beefc8e05143cb11ce823618e90f41d8e9ca0fd

SHA256
90a3b75e1d99da9263ebf0d1bb18c3138106d0ec8739bbf52f7511f2cf432516

SHA512
89ff353b74ebfa5b3de4704ce4ac844ed32e6331f536af033be29b4fa74d855a4fc7e701a23fdce9b9196495a1dd21cd9bc7b8db7218896e3bdbabf778641434

Download Submit
/data/data/butttots.plum676.sai/app_wedding/jdgnHyW.json

Filesize
4.9MB

MD5
406f2d1eb0cc6751866e3a0ebf788061

SHA1
5e4f6a97d26c1b2a7e2be6ae30852b114622e002

SHA256
6bed575fdd0782b35e71de40519f2413f4fa926784cff0af32d4360c92ef090f

SHA512
06c5866ca3066d07e4b08f1b2e2e29442226daa964f5d36b6e3f2014730476428b95a1be3105767d4b4829a3f28899bae7f97b0d25b7cc02371ce630171bef85

Download Submit
/data/data/butttots.plum676.sai/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/butttots.plum676.sai/databases/a-journal

Filesize
512B

MD5
6e4e358e69d76d6a45a4d2a1fa171659

SHA1
2754c7fc56852bc39cd280ebb092119fffd4c30c

SHA256
6f145155d5a3b49a2eb7dc18766cdcdf411108428d9ff9bd39bd0a8362123417

SHA512
38c32f1c8bc26b3ac9486192b8dfef0013e4633181bff46c6ea5e1467aff920bcc23c4e4bea12cf58e0bf66e5231a7254eb228720c57faa1c2fd99b4c1566279

Download Submit
/data/data/butttots.plum676.sai/databases/a-wal

Filesize
32KB

MD5
d63cd60b7f4e5ab7c094c7775182cf6c

SHA1
c10741f319fdd051edea4d9de301317200974f99

SHA256
479da7b05244993388ce45c4778c269deeb4564e21b6ca176ebc161d1276f2b7

SHA512
12a6cff77320d96fa1e4749747c21ce92b75018701edff97958320e3dce79b9932aac3783c9e3c86d19e930982b6f8709271e285580672db02664f08492cb7a3

Download Submit
/data/data/butttots.plum676.sai/files/butttots.plum676.sai

Filesize
256B

MD5
f8b942aebacfaffb9285c90a7f087c9b

SHA1
af17ae5881209a870324fe9aa73d9feb8564eff5

SHA256
fd0a9b8ca9f308c7d4dabfd3c15d0691b708af513c6f1580318cd1b7ccc07415

SHA512
57e8570899ecd8d0e333a6f02ee4edae5fe5789566cb76af1ef9f6871d9c80d05bce87be3098a32ae007e3cd3aa47277c38819879de41a071b1d45d3e905e2c7

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
9541abf9a619320c908d160c6b5ebc46

SHA1
d03a97eb208436a0f5baffbd0b797940b3f5f883

SHA256
8f0eb1c75ed75fac95f37757d9a81747d03e0bd26d51b84532f79cfd2617edd8

SHA512
a4bf2e9e606ddfec49694037d84ef198a46c727d4f2030b5f1b38cb5a799cb4d39d8ee30fc97b7d0d4a74b1a9a3b8b62d47afd90d0e0e434243cb4b3d1e88203

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
056f832ff9db0639ae505b4b5f6f0a22

SHA1
4a9513bf01a6d311cb32926c78e7afc35eba0d22

SHA256
2123ea0a874ea9e8760e872f953a3688eacfa777aa573cb3979acccd9a1901f2

SHA512
726c8fbfda006a283ea61e5bbba128dcca2fe49110498807c35efeeea24c7f13078a834893032a2b4032139e904585bbda20835392b062565a8f90da93ca8bf0

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ce85ab7879ea7384939407d9331c7c00

SHA1
3fd9749187f573168086b21f31572f700882d731

SHA256
0a2fa165b6e1376c49006c9cc6acd42df2b6586286c8da7c3460dbb5f3c21adf

SHA512
a2886d879dc1f49306664b324ae3bddc9e3e5449bffd7b10d2c66a4b32a4c0f67fb43440af1f8e1d312add595b49a8b49b36276cb5d9ad0fbe86fabda0c8e1bd

Download Submit
/data/data/butttots.plum676.sai/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d68c59157a5826a743e7b9c8a1d78a10

SHA1
c809ecf9636c6319b870bab568f86beea07b2569

SHA256
6dad5797bad789b186aca3772c9e14cdd382a5e6e95c3f5db6170c7dfd95cb11

SHA512
ada6ed7b17ee5a7abd0726fd9f634007255bb77d9f8633d26afb249d14ee711c90b8e32aa3c4fac72d4087aee4338a051c103e87dc3734eb73fc9d5e76ef48b7

Download Submit
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json

Filesize
10.9MB

MD5
b6c3becbe6aeeb86cc3690035eae8e29

SHA1
b9a508864a6dffe3eb80b3eb2ccd4ae510cd62cd

SHA256
0a82df303a40ec841716f73afc41ae8083f5b4d0775eee7f3ed421884c71723d

SHA512
ce00cb27ebf00fec2a8ed8cb3f8eeab0a9c55c10cb3c8bb4ff5b49e4c7123248b96a784a3124cb71f7cc24c60b6801e2048eb179a1a5bb41809f3c67088b95ec

Download Submit
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes2.dex

Filesize
309KB

MD5
d1e6566482927131289b625099f039ba

SHA1
5fddac3b2e8da86f56284989f7907beb3388463b

SHA256
16caf3fdf72c434d49cf7ecbcedffaf7c979306af2b85d658cf99c45319f401e

SHA512
40bed350b98ab8ca53e99d800bc255632379835d2ae4bf26b8a45ea174b4aa280f0e7fe086148316d485e6ea94cbd4c588d8f511ef0c1d76e98709f72f1cb504

Download Submit
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes3.dex

Filesize
267KB

MD5
d2cd609fb19e6b18227f994cf893813b

SHA1
a9ba8d38cc657616cc7f9833e900340e253d1495

SHA256
e91a92cbc28b5459a4a1aa25deede9437439c7d577fdff17cd374fd871cd4798

SHA512
cbeeb12c7d296d1ded6c5a305c123d31533ed188ecd05dcbc1c08f2fa77b05466ac7ecb511e9d6c1e153c1ae105cbd7524e4bedf664c169e936c42ba578ef8ab

Download Submit
/data/user/0/butttots.plum676.sai/app_wedding/jdgnHyW.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/butttots.plum676.sai/cache/logs/log.txt

Filesize
83B

MD5
368b92cddf1d44f624363f69ca5ff82a

SHA1
5c3057e374f2f4c4e028b80fbd6128e600c4ef7a

SHA256
69c778fc9e0b7ab7c974559b2398a3a343f05335508d384e181b7b49ac29e60c

SHA512
006e022b6e0eac1c819d6a56217ecd123487ab1c521be12336c060b359ed3c938be8eab765b37052e45b376c9c46abfbedaa39124b925a7881980adb25d28d12

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads