trickmo | 47c1a611304c0be57625c0590e06760096ad50ddde3608d77bf78bc82ec80a4d

Analysis

max time kernel
28s
max time network
25s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

8.6MB
MD5

7c33b8f6e8f2892eb3a96b0b607d36b1
SHA1

2233fa82bfa466913aed8faa2af26bb318df82da
SHA256

1c687269db68f08688066ef13e9ff36818fb0c4fdeb552392bd7fda318be84dc
SHA512

663b9d007977e368bf12c5d395aa88b92f850df792e134201a867ec20efb999cf4df74d5828cd7c23293f49bb00ae0b7abb18296d192e55ae704f0c6b578957e
SSDEEP

196608:GgMo0kHupyKLg13WJNE/E5N/XaPsj7oYZO+DFgxtw:RMsuyoBr6sZY+hgxe

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/neuli.ter584.li/app_coin/cb.json	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex	4214	neuli.ter584.li

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	neuli.ter584.li

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	neuli.ter584.li

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	neuli.ter584.li

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	neuli.ter584.li

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	neuli.ter584.li

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	neuli.ter584.li

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	neuli.ter584.li

neuli.ter584.li
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4214
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/neuli.ter584.li/app_coin/cb.json

Filesize
4.9MB

MD5
4140eaecd3a5123aa884c15856b4a9cb

SHA1
91683896b9f15479c35af075501a9d1739af8803

SHA256
95f8117d805ee5196fe750c970d8cd238f49430d2d1fa08f0b8bb51206996db3

SHA512
e97c3fb4012ec58e066500b65d07a15c1ccba05b91f18f1b216547547b77e6a4afd3a635ce06657cd1bf301c90983ec4bf8bcb4896059713fcad22ac29a2f58c

Download Submit
/data/data/neuli.ter584.li/app_coin/cb.json

Filesize
4.9MB

MD5
ad6ec3c1167f0718bcccbfdfbaba165e

SHA1
11524c3583591da843dd492ba9b2df967dd2d78d

SHA256
1418cc2f8a55028e45bcdacbcdc025ec1b6e7678a9a7875ddfdb769419e5051c

SHA512
26f99458d25ea77386356c42f21bf29c5ac8fd1bd3f615567ba019bcdc03493c3ab52055fdc6d7917971729f50e3a3f09d94e6143f69b273fec1481e26a56ac3

Download Submit
/data/data/neuli.ter584.li/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/neuli.ter584.li/databases/a-journal

Filesize
512B

MD5
9c5b6b2719b04eb58545742b959eee72

SHA1
bd5cdada891f8a0a2f5bca2c4f7de4bf3050b34b

SHA256
468dbd88c9a4f412ab3c0b42adf1f2c9bcd6daf86ec2700fa2ae2496928ec6a0

SHA512
83bfac459e4c694e0ae32339ad52f61e71fb267b2bd65ef400955d7a4c611cd75b764282de0b4cdba77ccd15bffb84fc40923d938a1fc9facf00694f2e3d2dd7

Download Submit
/data/data/neuli.ter584.li/databases/a-wal

Filesize
32KB

MD5
53c398379c39d9fbf392f6970ae8b706

SHA1
dcbe3aa2f7c2c8840d2a71d2926fe6d90acc9b30

SHA256
52353a10e196ff0311693d36528897143f6f14ce96574cef2c40a397b6ae655e

SHA512
3e88c2e088d4a0f559a0dc5c0c19cd217db424ba941e2116d3e355de5456d20cdcfbdfa2d9c469b04c0f15a8cf9039377f9a9bf153d53fdb866e22da1f05e055

Download Submit
/data/data/neuli.ter584.li/files/neuli.ter584.li

Filesize
256B

MD5
8eae2f4626b2a86de8f7adad83dfa514

SHA1
004d8d5cfbd538987dc77bd6cb6396e928523641

SHA256
1cf449fac40990a57723c664cef3b7da2e8a4240cf4ff6d736b426f76a6ca5eb

SHA512
b99278628a320b60a1cd9344c4cdd093e238818b0610f91615acd9635795b45279f5514b4273b94a2fc9930ef41cbfe75519a44bb104ecc265f17188e7caf57d

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
dbdeff6567d9a84281bb122b22458dff

SHA1
096fdef9f9c79aa10b8b3dfa64ce727372fc0820

SHA256
05f78e3e9bedd37cb677ff0c39461652389f21c728c15c39e9b36fe559a02c26

SHA512
c641be0f451a9426635d076f3602bd9be61e5cc94e49179ae8c21ee07007bae5e9361af0f7d06ff58fd3ae56edeb7a49a8de917b7499616ce91715875bd931f9

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9d898271e0b36f352f0ed774640b7af0

SHA1
c6fba35e0631b82ee240c73cb0528a2f5f5a93b0

SHA256
747bd1f16b21e09cae828150cad992dcba43a8a043aca2b068f8b0dabc992b84

SHA512
f574321bda282002fae27a1cb5b585d895a0f0feec44631cbc313a9b6e237c1e491f111abbb3996a183d3bd9438faeb7c44ed1c6ab7498d88997c9960305e704

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b14f1948666a336732c0b578303993c0

SHA1
4e6f2647c9e1d70ae473890595da39fbcd02bc4c

SHA256
6e402d64c050202b25f62ca3e49009ee38d4c7d5b939da69b7894345ad6d51c9

SHA512
ec606e0b9a10c90ff0e1213eaa95fb68950882dfd66fd4792f152710a1eeb3d39b15fe8298a6b408149013b818f0e9983a45f200b402c6b4a6ae36882ebe7324

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
921d8ffe6f5d871436bbda2d67b30b5e

SHA1
e9a43d6ae7e3ddad8046da9522c909de73d33d41

SHA256
8ae59eb4bd23c61a28ada3178cc262ab54956cf0f67e49d4b191fd82ac8337fa

SHA512
b695de471dc0df3bbbac9e380b6a425f408c7e9be5e26d2f809496e79a80b3cefb7dc501742dd386a6fef8b9eed162f4b8394d4b0105fa9d16602e41bc8d3722

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex

Filesize
308KB

MD5
c9b33ee563c706b95589b51a77666972

SHA1
dd4c6f1659a1037faed9fc8d77ba87097833f0b9

SHA256
26a158276b2ae50288d03b58676ec21fa272053e062f006a185cddf6e84fb5b8

SHA512
339714c27e675cca9bfa55f2f23c09945aa311af06965c851b5fddd8792552b23284ad93e2c3f0f2db3387e63d674ba5995625e94ddbc773bf3f4b7801294b22

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex

Filesize
265KB

MD5
6716a37b3c2cf93aaeca8c3cfdc8432d

SHA1
f56e7d26afed360f74cc0bd9693074d81c50cce8

SHA256
47f93d71390617553f8e23eec1d18c9a28e87982d7d83302b00983a6e552df51

SHA512
2ca3515ca4619d4bebd0315042f83ef89af968a3252852fd6239c28b14b8bb0b8cf3734be78fb32a42a14772a6b025a98940878ebbe3cd90b6d32b5920a356c5

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/neuli.ter584.li/cache/logs/log.txt

Filesize
83B

MD5
4fed541c322e2686dc4ca258d3465b17

SHA1
6764d86b2d309ae189226baaa1a392d61954e837

SHA256
0341a08f4b9f4cbe400e9a0d54bf09001c2c90d7d8d76b19fc7ae1d298c5f8b7

SHA512
b471f55a4255627566b69937224495b3027148dbdddd468620600d1574e95148aa5ae8c7261a8b13c497a167aa67f2fb0b104e9ffd665b9465bf8e148bdf49fb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads