trickmo | bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2 | Triage

Sharing

General

Target

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
Size

7.4MB
Sample

250322-afqt8axnw9
MD5

b228cff097466d7a5077ef6ac94ac862
SHA1

3405bbe0c7703dbb6e5829b90e25d0efebe6b9d7
SHA256

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
SHA512

f807fadd8e450c7b2a53ed387211059046cdd4fa030a0f7c6525e983e4fa3d263ce86bb9e4c9804fa239a0e57e016d703761b055e3dc0efd68327d5ca4e8b4ba
SSDEEP

196608:8XBBT18xyoVgPdynjh9Z7qNK3zI7cS83nP4/nh7jTi72I+5FZzorwUWDV:+XT1Mcc9Z7wb7of4/h7jQ2jOrRM

Score

10^/10

trickmo android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

C2

http://techpoint.cn.com/c

Targets

- Target
  
  bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
- Size
  
  7.4MB
- MD5
  
  b228cff097466d7a5077ef6ac94ac862
- SHA1
  
  3405bbe0c7703dbb6e5829b90e25d0efebe6b9d7
- SHA256
  
  bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
- SHA512
  
  f807fadd8e450c7b2a53ed387211059046cdd4fa030a0f7c6525e983e4fa3d263ce86bb9e4c9804fa239a0e57e016d703761b055e3dc0efd68327d5ca4e8b4ba
- SSDEEP
  
  196608:8XBBT18xyoVgPdynjh9Z7qNK3zI7cS83nP4/nh7jTi72I+5FZzorwUWDV:+XT1Mcc9Z7wb7of4/h7jQ2jOrRM
Score

10^/10

trickmo banker evasion execution impact infostealer persistence trojan collection credential_access defense_evasion discovery
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Tasks

static1

behavioral1

trickmobankerevasionexecutionimpactinfostealerpersistencetrojan

behavioral2

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan