Analysis
-
max time kernel
90s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:09
General
-
Target
deper.apk
-
Size
8.6MB
-
MD5
7c33b8f6e8f2892eb3a96b0b607d36b1
-
SHA1
2233fa82bfa466913aed8faa2af26bb318df82da
-
SHA256
1c687269db68f08688066ef13e9ff36818fb0c4fdeb552392bd7fda318be84dc
-
SHA512
663b9d007977e368bf12c5d395aa88b92f850df792e134201a867ec20efb999cf4df74d5828cd7c23293f49bb00ae0b7abb18296d192e55ae704f0c6b578957e
-
SSDEEP
196608:GgMo0kHupyKLg13WJNE/E5N/XaPsj7oYZO+DFgxtw:RMsuyoBr6sZY+hgxe
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
neuli.ter584.li1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54140eaecd3a5123aa884c15856b4a9cb
SHA191683896b9f15479c35af075501a9d1739af8803
SHA25695f8117d805ee5196fe750c970d8cd238f49430d2d1fa08f0b8bb51206996db3
SHA512e97c3fb4012ec58e066500b65d07a15c1ccba05b91f18f1b216547547b77e6a4afd3a635ce06657cd1bf301c90983ec4bf8bcb4896059713fcad22ac29a2f58c
-
Filesize
4.9MB
MD5ad6ec3c1167f0718bcccbfdfbaba165e
SHA111524c3583591da843dd492ba9b2df967dd2d78d
SHA2561418cc2f8a55028e45bcdacbcdc025ec1b6e7678a9a7875ddfdb769419e5051c
SHA51226f99458d25ea77386356c42f21bf29c5ac8fd1bd3f615567ba019bcdc03493c3ab52055fdc6d7917971729f50e3a3f09d94e6143f69b273fec1481e26a56ac3
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD593e7f88ba7fd4f0152e8e5dc56f1acc0
SHA1f29883585567a32fe4d487e5df14173c39c09e65
SHA256dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c
SHA512be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745
-
Filesize
512B
MD5d1620523dc01d0822cd65e7dbb3745d7
SHA14de7ae89d170c37681c6fa744ec09694e391c0d1
SHA2565bb4d5734d004247149e4b62181490d66e38f170f2661802b7946c38ea9fb6f3
SHA51287a7fa68110331477ffc8936f1e0d6f9dd8e7b349e2c6760e5127f22b32dacf0f734c3279f3e2e0a7a50dbda8a3622e7b79b6d8cfcceac29f38fcbe917b2eb76
-
Filesize
8KB
MD56f2883298edbfca8ec10943fe8adc9eb
SHA1038ad619d13291ed1b1bb883af10b4e1e54e903f
SHA256a685bc308f4e2e66465cb12e216aa74b1632b34a8abbb752d9741f37768286a2
SHA512000a01c918328374c1d9bf0600e8599ca5dbc3c84f713a9b2237a056a522192d0d2d2fc352e4da83192c555d22cc02a4e2280fe9e291a7bdfce6ca894bb21296
-
Filesize
8KB
MD582db7894f02bcaad94265e31ad409fe4
SHA162ebb7c922a17ce3d0b1252d747b0045ca5ccf29
SHA256bffbf920b3a20fb68a0af81da600567349405c3c8d6019cef4d17f518f1b3888
SHA5120862d29296c2538e8644df4920b513232c53b5e24a484cdba39f5d5b6c4c54b62be38c6d4feb9eee9da4b12f31cf01cd37d5afdd01e2b6e9df5cc7ddb057ddfb
-
Filesize
256B
MD521cf42f2dd2d7d8aad3726820de9d9d6
SHA12aaafc643a075c04d11b4e328cc1ff4c1b5192f2
SHA256ac1a9308c2d60dcc2f32c314df32f54980031b22f87e569c16c93bd53a9aa9f4
SHA51201363e4f32ced0a0e05062e733f2af36cac19fec19fab93be8f4eb13d18b0a4ac2b9685a48391bd84ef76aaae350d22514bd47a5510f79f3340910fa8f278413
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD54b7727bd89d310f3facf76195fc53ecc
SHA1c19191024805c6e69ff1b30b6b059d23631ef910
SHA2565538ab168d1a4f83ce1c8a6ea0774e7aa73536e23bf80a17c5006fa75954c433
SHA5129d6fc719f1d125ec78b545c0abc11c4b25a6ad4b4e62ffdf70d7466d976adb7f25cfaa6d88a815b1d7dde02b64853df93bf333360e7062f99ed0caeff5c0f0c0
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD59d87207b8ae35642ea40caa86bd71f6c
SHA1d9283d49e6c495c909f6bb9c0fee1910543427d5
SHA256b600e4d982fb57a8dbb61dda5fbbd4485d90d04b05473dc2a2dcb52eb4e48505
SHA5125c3ea65a3477a09ffc4c7b1408afd3985409e7614f0751cecc17af9f637d269e13f97f26698d2c8c6438a18d21daa48dcff647395c52f3b6881d361fb5c18a2a
-
Filesize
16KB
MD501212cee60b375a1c70f6abe46d7d52f
SHA121a90a67b845bc91c992f6888b60cb11a917c352
SHA2563f623554337433cc9a7217838e5f39dca7e1f4b29a6d9ff2fc79b659cbe46484
SHA512cecaadb3f4a0be796070fc5086c76d9275cc433845fc0edf7ad7b543251c57fdc8267fade9a811bb76365e0fa8337b8fd2d648b620c6f2b6c4af392c47b47c53
-
Filesize
108KB
MD553445044b01d79deb42cb3c159a1e0cb
SHA138377c14e1aefce1e29d0ba49bb2a16f17c51702
SHA256c20f937c2d514e74bd2d6fe54af7addb8837f0ddf151be4241855257919eca54
SHA51216fc617ecf8a94ae39f303f84753d29d9008a0f7700df264c472a1de89a4d8b01083b3a44a598f03a4b34250313b91a0e34eaa269105ba67143284319c506a82
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c9b33ee563c706b95589b51a77666972
SHA1dd4c6f1659a1037faed9fc8d77ba87097833f0b9
SHA25626a158276b2ae50288d03b58676ec21fa272053e062f006a185cddf6e84fb5b8
SHA512339714c27e675cca9bfa55f2f23c09945aa311af06965c851b5fddd8792552b23284ad93e2c3f0f2db3387e63d674ba5995625e94ddbc773bf3f4b7801294b22
-
Filesize
265KB
MD56716a37b3c2cf93aaeca8c3cfdc8432d
SHA1f56e7d26afed360f74cc0bd9693074d81c50cce8
SHA25647f93d71390617553f8e23eec1d18c9a28e87982d7d83302b00983a6e552df51
SHA5122ca3515ca4619d4bebd0315042f83ef89af968a3252852fd6239c28b14b8bb0b8cf3734be78fb32a42a14772a6b025a98940878ebbe3cd90b6d32b5920a356c5
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5116ddea88cd0cdf6ed9dd058365bd4e3
SHA13424470aec0006b7ba4fb48eabca2ded945b8d9b
SHA256534aba6d4697921feb85dbd7387c0078383a230eb3cb963a7a1a47f0a3460d63
SHA5121ac1c06385a0bb6b8ab17a0145740bc0d5827f615e05a05ef8e6deb3dc0eb02dc570a963b253ab731d7dbc4b9639e310d1ae871f8237afb195cc347b28cfdf7c