Analysis
-
max time kernel
90s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:09
General
-
Target
deper.apk
-
Size
8.6MB
-
MD5
7c33b8f6e8f2892eb3a96b0b607d36b1
-
SHA1
2233fa82bfa466913aed8faa2af26bb318df82da
-
SHA256
1c687269db68f08688066ef13e9ff36818fb0c4fdeb552392bd7fda318be84dc
-
SHA512
663b9d007977e368bf12c5d395aa88b92f850df792e134201a867ec20efb999cf4df74d5828cd7c23293f49bb00ae0b7abb18296d192e55ae704f0c6b578957e
-
SSDEEP
196608:GgMo0kHupyKLg13WJNE/E5N/XaPsj7oYZO+DFgxtw:RMsuyoBr6sZY+hgxe
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
neuli.ter584.li1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54140eaecd3a5123aa884c15856b4a9cb
SHA191683896b9f15479c35af075501a9d1739af8803
SHA25695f8117d805ee5196fe750c970d8cd238f49430d2d1fa08f0b8bb51206996db3
SHA512e97c3fb4012ec58e066500b65d07a15c1ccba05b91f18f1b216547547b77e6a4afd3a635ce06657cd1bf301c90983ec4bf8bcb4896059713fcad22ac29a2f58c
-
Filesize
4.9MB
MD5ad6ec3c1167f0718bcccbfdfbaba165e
SHA111524c3583591da843dd492ba9b2df967dd2d78d
SHA2561418cc2f8a55028e45bcdacbcdc025ec1b6e7678a9a7875ddfdb769419e5051c
SHA51226f99458d25ea77386356c42f21bf29c5ac8fd1bd3f615567ba019bcdc03493c3ab52055fdc6d7917971729f50e3a3f09d94e6143f69b273fec1481e26a56ac3
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD57ea510d2c2819bf8c669a258d846742e
SHA12d93f9988e9aeddd838c7da6ce4c5b0c04f03ba5
SHA256deec361f739ec7d6ed3cc0a7257fd327bf9e3791c661910074f57ff848014dd5
SHA5124295142f958b0b94932c8373276492c1c41544ee8e71502472b3e5f032efc500c12064630d2c7a9e0dbd1522a73b5b2008de8272460a57d074b7936f3427a1a5
-
Filesize
8KB
MD5576fe0f9a17a8be53eef85909d15da18
SHA10c3558fae01670c6e9ca7c56764f2aee609dc79a
SHA25699c57730760af728156bc35ee90e1ebdaa26e7308d217cf1685a4ad2668e9fee
SHA5123e152a51e3f6994b52ea49a0d43bec79e71ab8e327e0edbf9ef6502d43664b70b43f7744486af57de14c6d208a9595a606f5cd62f1918595d2a4eecd69288309
-
Filesize
8KB
MD57378ed4c11f39edf4424f3efaaed4a14
SHA198c576b45f6a6a167e2a75a927f1730388b990ed
SHA256eeb0df7e334aaa5f3f795d63873f67e9d8a3573f6a6bc58f2fdea5e40687b6ce
SHA512939e51a876ea468714fa70b47dacf8582b6c2c5c290c01c1148659ee2abee867a4f463f574408393c0c65a6a04267903a1d34014849127b494d29290388f86cb
-
Filesize
256B
MD55fc8558438ded2ba04c39ff94ef6f424
SHA1271cdbc8fd28bc34226aeca2bda73b2aa0c8a178
SHA25656b644831949397e7411a8bd0911df63d451fdeb0630fcf1c3cf116ded068e7f
SHA512151fc365fecfb90624ae2b11ddec68de40966b42afe5c081c9bc4bd49fa70f48a14d1fbbab3d05a80ae4ebe85d29eb651429d55d430e1b77b67e935fc908d635
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD54f2391a955c65772011dda103f179c64
SHA1681381a1316e5a48799aec4f905d13e8d7931cfa
SHA2561db81de72532774ec42628b5feb5fb74a52aef6789eb27d00f224d986fabb135
SHA51284f9b4ee35b54f887e7b1b140ec9d529f6a65bb137109018446e57587827c36b46c356fa35ce0338c810c18ba44f7ffb05c6301f74dc92b5408e483c9e44e56f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD51726895e37dc3243160ed227c2180135
SHA145f5e247248857d4fa05fe09f6bbb00594905167
SHA25641d0cd5ebfef823eb4dd89740f6c293c8691d29fe1baf20e17a0c89c811d1e0d
SHA512f1def334c0d178b3733889ff65dc8211af02d04072451350ca1fbbb28bbeb50c28818e5a08b5306dccff456b235b1563b2393cccea3fbb080bdc2af886aea520
-
Filesize
16KB
MD56f4e6917d82ffb0d54dffad4716d3fbf
SHA1a311ee97b672aac394bf562f0cb453225ca0dc29
SHA25620c3e78c47ebd6c741ccbd5c11c78e0bbe28dead346a64f525dd55be86c6f1e2
SHA5122575c433512914d6125bee020876cfde4dd393d1f2856431541db1576de9c10f65ede4766854b0e2a5c0a3f0a396f587da69d45ba9c40834e3b8c366656adb9c
-
Filesize
108KB
MD54d4d67f235d1e9579b3b58e7e6ca2944
SHA143b812e48ac9013f8b9b4e4aec88462df991b9d8
SHA256d93b6a9770e21e58ff0b883b779f1889d68493588c599d129bc42b9ed415602c
SHA512d11ffa249a06783891b9f4eb6ad63ad469055585d35424da14fac3c16a87bdc6d9f9364834c51803acd3b7ffb89c7006c21ce046d27ac1203bd44edb94dd2802
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c9b33ee563c706b95589b51a77666972
SHA1dd4c6f1659a1037faed9fc8d77ba87097833f0b9
SHA25626a158276b2ae50288d03b58676ec21fa272053e062f006a185cddf6e84fb5b8
SHA512339714c27e675cca9bfa55f2f23c09945aa311af06965c851b5fddd8792552b23284ad93e2c3f0f2db3387e63d674ba5995625e94ddbc773bf3f4b7801294b22
-
Filesize
265KB
MD56716a37b3c2cf93aaeca8c3cfdc8432d
SHA1f56e7d26afed360f74cc0bd9693074d81c50cce8
SHA25647f93d71390617553f8e23eec1d18c9a28e87982d7d83302b00983a6e552df51
SHA5122ca3515ca4619d4bebd0315042f83ef89af968a3252852fd6239c28b14b8bb0b8cf3734be78fb32a42a14772a6b025a98940878ebbe3cd90b6d32b5920a356c5
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5116ddea88cd0cdf6ed9dd058365bd4e3
SHA13424470aec0006b7ba4fb48eabca2ded945b8d9b
SHA256534aba6d4697921feb85dbd7387c0078383a230eb3cb963a7a1a47f0a3460d63
SHA5121ac1c06385a0bb6b8ab17a0145740bc0d5827f615e05a05ef8e6deb3dc0eb02dc570a963b253ab731d7dbc4b9639e310d1ae871f8237afb195cc347b28cfdf7c