trickmo | bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2

Analysis

max time kernel
28s
max time network
24s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2.apk
Size

7.4MB
MD5

b228cff097466d7a5077ef6ac94ac862
SHA1

3405bbe0c7703dbb6e5829b90e25d0efebe6b9d7
SHA256

bbefddee16638eedbea8c970dbf9f052aa4e42c5cc7cee59b8758788a27e98d2
SHA512

f807fadd8e450c7b2a53ed387211059046cdd4fa030a0f7c6525e983e4fa3d263ce86bb9e4c9804fa239a0e57e016d703761b055e3dc0efd68327d5ca4e8b4ba
SSDEEP

196608:8XBBT18xyoVgPdynjh9Z7qNK3zI7cS83nP4/nh7jTi72I+5FZzorwUWDV:+XT1Mcc9Z7wb7of4/h7jQ2jOrRM

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hinjohn.dad249.ta/app_love/By.json	4240	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex	4240	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex	4240	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex	4240	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_love/By.json	4214	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex	4214	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex	4214	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex	4214	hinjohn.dad249.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hinjohn.dad249.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hinjohn.dad249.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hinjohn.dad249.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	hinjohn.dad249.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hinjohn.dad249.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	hinjohn.dad249.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hinjohn.dad249.ta

hinjohn.dad249.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4214
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_love/By.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_love/oat/x86/By.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4240

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hinjohn.dad249.ta/app_love/By.json

Filesize
5.2MB

MD5
4fbb4028718532d32e22239261a76c29

SHA1
21291bfaab1fe037a003feaf8fd8ca01c800dd6a

SHA256
ad0581c6e1a840d93765648b854037e116402f247126ff01eaf6e37e6298c120

SHA512
92bde62f07d7953ed5f048acc0349ff6ffab105abf6dfcc1e4011873df7d649ddbbbd68bd0d6f47677f8ea08d6f1912e653ee274ba3895c07a70c9499c078979

Download Submit
/data/data/hinjohn.dad249.ta/app_love/By.json

Filesize
5.2MB

MD5
02bb31370c476d5d188123d472930ccd

SHA1
41423584d5c1cc00ee94541e7a42c7b75d215079

SHA256
daed2788794875c06c74734d96fa2ce8de613defa13b7355f3be5033f66a1055

SHA512
17b5dbb3fa3dbed0e9bfa2702ec7c25b43794b7b70bed37810d8b45f0e4d1a50951f2c350fde2d5ecd7b77d961c20cc70e39d24ac7492e965d6977dd7b4741d2

Download Submit
/data/data/hinjohn.dad249.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
512B

MD5
2173e4c01b26ae933820852643413524

SHA1
ffd0675feb4489621816a43ac14d462b71f7eb04

SHA256
43aee60a8835bb1cc12c76f50994cf39fad60a1bac770a52278b2f724ffebb26

SHA512
aec344b22b905ebbb328d72e1b8cea7032adf1a165086f8269f618c8372b56bede371a0fb5b80d86a09827a9bd69adf787a3511f44da32f52c8175145036bb14

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-wal

Filesize
32KB

MD5
97c42abafda3ac20f741557323fc9790

SHA1
e57d3320109d3381a588daf8ca073e7e2138bacd

SHA256
6554a8c0524ff035aae5008959ff5573cee5ac007115976a366b74664985347d

SHA512
5f6032a0563e23f1185ce7f3b30260b944af7f7db0118b3bb90ee18b53454d675c8dca5051095e271740687dd5f15893000efb3d9a0cd8ca7e78ad9cd258c279

Download Submit
/data/data/hinjohn.dad249.ta/files/hinjohn.dad249.ta

Filesize
256B

MD5
399933791f02f5544915b15a9a616693

SHA1
7ae1cfc6eddd48884cf69355911cab5d0d1c1bdb

SHA256
85cf44e1e841587a08fc5199ff491e7002ed0dbe8e644b2d8de411ee22e5f508

SHA512
416c61887a6d10ba39288bae4467ae7f17c6b7efb66791f7cb8d3362ae880e142569817270a4b3b9c3e6f49535fc378638d88fb6bb608d72e88fc5e06a77694c

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
dd1429726ac3d4a1d8b65b006ee2e414

SHA1
109767ecf13aa6e63120ce9451125825aca0d7db

SHA256
b2dbb1a72f94d9396bb549a62e964de96eb759cff525bf11807712a73bf450d9

SHA512
ef9540486c003ef9ca159627bc36d2033f33f03806921a67235bf028ff395edf172a8a67d40f38aa34ee4ececbdec115c3f90047d0802a422a8c134f129ea549

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0dc3fd04b27d61c5913d353e68de3254

SHA1
562a3ed729cd9d849f9de039dae8697734a9fa12

SHA256
20fb4f60556056f2645827d73edc0799f84fde9e362e2a25cf9e7dff9b868e26

SHA512
3f1af7ed0e4996ae6c25c0fc5af0f02774f28a5288a92ac18ddd591c352faf96bafb0ab9b960e5e7e330ec1b96a843467db5aad3d2c0e76aec766772567a178f

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
baf7fd86a1922eab136ca1cfcee81c5d

SHA1
9f3a7d6f8d42bde77a4babc47ca6824808e2dd17

SHA256
36f5aa6aee88348843f0998dd180467b2d64a5c130e65c2eb85ba8b8457b9218

SHA512
646a900a12783aa2eae6e375bb5432b3731c2747bf741c00452d13030bea2a8f65a9ee73ee605942954700ab1a4cf8235974feb98771ce0b30049ea22d6de11d

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f0ed4dd517ec81ea4faf4193d5d2f746

SHA1
e53c3b826459dc1539153a0ad3753232ec506506

SHA256
356ad606be4f035ff7340a7da97a5d37cc196dce6c4a9a605e15cc5e59740776

SHA512
cbd30aa3d065fa3aaaac70c4f73684d26ab7fb735a61f6ac9a24c362bfdc04b88d30b735133ffa043eb4793033c9af7a11f4fbfe75f8be2238e3eb35212e8bc6

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes2.dex

Filesize
351KB

MD5
5a6c21c97564f9a1e87f8d7f10c4a768

SHA1
1e5f3c0425f58d762043761315dbe272245a6be6

SHA256
0560c1387efd41865f075e176b7d4875340db043d943c95f0ad11f0f684fc519

SHA512
e823cfa4c5dd345e9f68aeeac384d42797ed1419eb70ea99d122a6c20a066a97fb94ce7dd6037b743d82eaa21bab2974213027c5e3a03af95c6c8ec513b7ec6b

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes3.dex

Filesize
257KB

MD5
b9c73c4d9fcf118ac64a47bdfb8bb561

SHA1
f74dec2bb9dc1c5050ad66937ecb844b915a06b9

SHA256
31b28132c9fac2f1062b7eeb45e2c281d65d19dc03805a7e4e4122fa492ffb1c

SHA512
750c57fa2798de21de00d20cd86cab0c12e4e7d5d3c8978f6c674fec404b6aacfa9b3bdf03d0da0f0bb16fd62928dc625e3ccb135699757bd16ec3e7e379d375

Download Submit
/data/user/0/hinjohn.dad249.ta/app_love/By.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/hinjohn.dad249.ta/cache/logs/log.txt

Filesize
83B

MD5
f96f1a231fc1a1d5a8af708ce49357b1

SHA1
f626470dc28027d1270b9f6e1e0551811d6a3644

SHA256
41b6fea86643a991c654325b66cad24228f86650b171ad597185c19c299fcd00

SHA512
6e57b10b130a1fb874af30e26947fdb0e452fdb195098039cc9e309e23d6fc0d72ac7409b82c89a74458a75193e8b5d7648184b881b33778aa8462248de29aef

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads