trickmo | 47c1a611304c0be57625c0590e06760096ad50ddde3608d77bf78bc82ec80a4d

Analysis

max time kernel
90s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

8.6MB
MD5

7c33b8f6e8f2892eb3a96b0b607d36b1
SHA1

2233fa82bfa466913aed8faa2af26bb318df82da
SHA256

1c687269db68f08688066ef13e9ff36818fb0c4fdeb552392bd7fda318be84dc
SHA512

663b9d007977e368bf12c5d395aa88b92f850df792e134201a867ec20efb999cf4df74d5828cd7c23293f49bb00ae0b7abb18296d192e55ae704f0c6b578957e
SSDEEP

196608:GgMo0kHupyKLg13WJNE/E5N/XaPsj7oYZO+DFgxtw:RMsuyoBr6sZY+hgxe

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://somakeawish.com/hpuex9yu0lfad7pjoxcl

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/neuli.ter584.li/app_coin/cb.json	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex	4241	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/neuli.ter584.li/app_coin/cb.json	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex	4214	neuli.ter584.li
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex	4214	neuli.ter584.li

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	neuli.ter584.li

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	neuli.ter584.li

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	neuli.ter584.li

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	neuli.ter584.li

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	neuli.ter584.li

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	neuli.ter584.li

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	neuli.ter584.li

neuli.ter584.li
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4214
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/neuli.ter584.li/app_coin/cb.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/neuli.ter584.li/app_coin/oat/x86/cb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/neuli.ter584.li/app_coin/cb.json

Filesize
4.9MB

MD5
4140eaecd3a5123aa884c15856b4a9cb

SHA1
91683896b9f15479c35af075501a9d1739af8803

SHA256
95f8117d805ee5196fe750c970d8cd238f49430d2d1fa08f0b8bb51206996db3

SHA512
e97c3fb4012ec58e066500b65d07a15c1ccba05b91f18f1b216547547b77e6a4afd3a635ce06657cd1bf301c90983ec4bf8bcb4896059713fcad22ac29a2f58c

Download Submit
/data/data/neuli.ter584.li/app_coin/cb.json

Filesize
4.9MB

MD5
ad6ec3c1167f0718bcccbfdfbaba165e

SHA1
11524c3583591da843dd492ba9b2df967dd2d78d

SHA256
1418cc2f8a55028e45bcdacbcdc025ec1b6e7678a9a7875ddfdb769419e5051c

SHA512
26f99458d25ea77386356c42f21bf29c5ac8fd1bd3f615567ba019bcdc03493c3ab52055fdc6d7917971729f50e3a3f09d94e6143f69b273fec1481e26a56ac3

Download Submit
/data/data/neuli.ter584.li/cache/clicker.json

Filesize
20KB

MD5
2a08aa3691d360c2ff0815d0b7812fde

SHA1
50c37f212fd78fb89ecb00f81656723ef28fd53f

SHA256
ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c

SHA512
d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89

Download Submit
/data/data/neuli.ter584.li/databases/a-journal

Filesize
512B

MD5
2b3f31e212813cee8860358093718e55

SHA1
73f04682ecb821ad766541361cef840687dd88b4

SHA256
e0762642df0b95db4579275a1289ae0eb4a3b38ff1c4d5c2daa6621b6e53314c

SHA512
c753d819bb47ad9a693eb763e584ea3ac2421db7b67519f05bc8704639f21efeeccb164c3c4eed9294108f8c6ffa4c5cbd685cf7fdd2870fd2fccb62b9e5bc74

Download Submit
/data/data/neuli.ter584.li/databases/a-wal

Filesize
32KB

MD5
917cea3a4d98a0d55962dd4cf4477964

SHA1
a04d5aa1215a471a7430dbfad18baa0031e3a365

SHA256
47fedbf7eb8990826b595b31b020c3b4a94052a542e103f7272825608530e7a1

SHA512
48de6eec99b2e4b46ad32fcda86ed224e7c1a66a142e23505f4db394cd27cfd9e63ac92a2fe8acbacd5a3c950b3e387c61f2e5ede1736a64dc2e86912c13d6c4

Download Submit
/data/data/neuli.ter584.li/files/neuli.ter584.li

Filesize
256B

MD5
18360aec2893c137eb5fb07fd46fb918

SHA1
d6505695e02c162f8df2b0419b3c5a229bc1a18a

SHA256
9141f83f58b375c099070f6aac39ac57255cefd3dab53283cc86cf4179472e99

SHA512
63958d7354c2ff5dcfd2b22fef6cc95a82e34751581fe43a3459a1da04e7a9e6b4752619dec3adb5c4e63873acb9ed193777f614b403db40bf56f142ae5de20a

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
30a159f3f6291acd85a56f28ad398670

SHA1
fa2773f92ffdbcd89d1ffd16de5e29fa85d04c7b

SHA256
b067ca7710c753f9594d2b46e0470ded752e1d3db65a7da16f57ff9d0d1fcc2a

SHA512
3a12b1ae257e5ff163ec1b34b438cd86fb66a9dbb15da5fdb5c10edcb2f97d0d32b0baf17cbc3ce094e3bb1f5156ae22c39b3088d78e501f099e85c1e603f9a4

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
714e90ae761e04a20ca2ff96abbfdfdb

SHA1
875f9b4157ffd10c71b89b2de844bf707d51ea1f

SHA256
0a73d3035fb2ccfab736a23cae7e956dde9e533cbb57fbf384707f5b12b8454e

SHA512
0e89ba2af4976db7c710b0533bf8c921c655a3a797a42a71db4016c5d33982adfc205b7797cc982b94fc6b6348eca370434a483419fd06fd9607d900b5f33959

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
e2f1f850a26dae1ac9e16e86607d5bbd

SHA1
c3fe4ab4a01cb9d1cc50394720f3cbf2701e02fc

SHA256
a84905f97560dabea25e9a2926269c7f3d779414f35f06569064e7af75794e9e

SHA512
96c83a654757915bdb160c7778938f4f53bd11afd0a72ab74c573ff7f510643fc7e1de85b4fe63b1af0fa4a4fe9f237dc763625484833e92ea25ac70e7bd6431

Download Submit
/data/data/neuli.ter584.li/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
966c68be27c4b612b68295d126d15ec8

SHA1
5cc0c5df9a3cf1f174935a1ea354d73621d95cae

SHA256
4faba5f77ab659eeeee508488d92ea1296f81a6cfd1f7ef85d9c42ccbbc7e439

SHA512
16019c51136d976b9b059f5d8ccd6f981ac3f1efdf1f177bde77ea253f0d73c54380f4edcba20ff5914aab0afb9adffce24464b474f684e166fbecc1f62884a8

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes2.dex

Filesize
308KB

MD5
c9b33ee563c706b95589b51a77666972

SHA1
dd4c6f1659a1037faed9fc8d77ba87097833f0b9

SHA256
26a158276b2ae50288d03b58676ec21fa272053e062f006a185cddf6e84fb5b8

SHA512
339714c27e675cca9bfa55f2f23c09945aa311af06965c851b5fddd8792552b23284ad93e2c3f0f2db3387e63d674ba5995625e94ddbc773bf3f4b7801294b22

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes3.dex

Filesize
265KB

MD5
6716a37b3c2cf93aaeca8c3cfdc8432d

SHA1
f56e7d26afed360f74cc0bd9693074d81c50cce8

SHA256
47f93d71390617553f8e23eec1d18c9a28e87982d7d83302b00983a6e552df51

SHA512
2ca3515ca4619d4bebd0315042f83ef89af968a3252852fd6239c28b14b8bb0b8cf3734be78fb32a42a14772a6b025a98940878ebbe3cd90b6d32b5920a356c5

Download Submit
/data/user/0/neuli.ter584.li/app_coin/cb.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/neuli.ter584.li/cache/logs/log.txt

Filesize
83B

MD5
116ddea88cd0cdf6ed9dd058365bd4e3

SHA1
3424470aec0006b7ba4fb48eabca2ded945b8d9b

SHA256
534aba6d4697921feb85dbd7387c0078383a230eb3cb963a7a1a47f0a3460d63

SHA512
1ac1c06385a0bb6b8ab17a0145740bc0d5827f615e05a05ef8e6deb3dc0eb02dc570a963b253ab731d7dbc4b9639e310d1ae871f8237afb195cc347b28cfdf7c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads