trickmo | 07b114daff3e1edd5e7f1a2f813cd7dda6f3902cda03f1a8f4ecf230efa52ef9

Analysis

max time kernel
126s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deper.apk
Size

6.8MB
MD5

fb036e22c765cf7dfa625b25ed43b520
SHA1

bf36e7998e76f1b6d64b833fce4e2fbd2df67621
SHA256

0f0f6a50d4d96be437251a0029aebb34b53fdf4b3adb838dcffd217bd657e6d3
SHA512

aad2051941c707d8cbd2f2e26000d1835f11cc5ae503776213ca4e81c8d96c9fb0acbee0d46ddd3a687ef2ab8cd37df062500d29270519d27a4f60ad51c5d135
SSDEEP

196608:84NS+koOTZwleubHrPlCDruIexT2FDuxgey:5NpOissrlCvuIexiqxgey

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://traktortany.org/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json	4233	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_dawn/oat/x86/ZldSO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes2.dex	4233	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_dawn/oat/x86/ZldSO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes3.dex	4233	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_dawn/oat/x86/ZldSO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes4.dex	4233	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_dawn/oat/x86/ZldSO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json	4207	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes2.dex	4207	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes3.dex	4207	lansa.sis722.sers
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes4.dex	4207	lansa.sis722.sers

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lansa.sis722.sers

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	lansa.sis722.sers

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lansa.sis722.sers

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lansa.sis722.sers

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	lansa.sis722.sers

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lansa.sis722.sers

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lansa.sis722.sers

lansa.sis722.sers
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4207
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lansa.sis722.sers/app_dawn/oat/x86/ZldSO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4233

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/lansa.sis722.sers/app_dawn/ZldSO.json

Filesize
4.9MB

MD5
c061bae620d91be24cb526c28bd172f0

SHA1
5b7d9ca0978aa2ecbddac34adbc1366d346298fb

SHA256
8677bdce1bfa345d8d393ffd9b4495d0f11916c3e8b78e3c3a0e869fb1f50b26

SHA512
7cabc200ca22bc0285a424ff8ba7a974ddcc86e0d7049e02b0f0819f141f4b31f6eabcfc55725c493c511caeace038bda82c3f271fae068020bdd5797525efe4

Download Submit
/data/data/lansa.sis722.sers/app_dawn/ZldSO.json

Filesize
4.9MB

MD5
7de90707f33dcd6b4c16c5030a7cb478

SHA1
007c067a2a164d68b2a82eeb19fcaaa3633e0c1b

SHA256
7d4b7850eba8e805a62f8de97fd8bf60e61d2da62425c34ae80adc635a3053f6

SHA512
8370bba49ca500788beeacf0e895a103b9010db3b4de3098993853c70f2726a9615ec9f560ab8cc5eac01f7e196f834d04da31eb64029b552b590fcc59f5f5b1

Download Submit
/data/data/lansa.sis722.sers/cache/clicker.json

Filesize
20KB

MD5
e48ae2e98ea5b39dd12819b5cceb7dc3

SHA1
219af8ebe9bb26b76eaa53356a613e5fbb806dea

SHA256
6e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9

SHA512
443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1

Download Submit
/data/data/lansa.sis722.sers/databases/a-journal

Filesize
512B

MD5
d37850a29779e6e981eb5cde29f93892

SHA1
d90224dfe1e5a351e8a7ca0208772fdc9d22e435

SHA256
0addbada99de49c9f643d2d3ab73bdf3dc6dd624c8de14bbce27be4ab4c86ae7

SHA512
1e35cd0fbf6763cd4e0ff47fac01a24508f61eecbdb122d49a72afc22c0486f22815f28df0c3695915d06250d50f7ae4ad1e251d833ad97137c7b5d7c52e75c3

Download Submit
/data/data/lansa.sis722.sers/databases/a-wal

Filesize
32KB

MD5
537dd324618386706560dd93778d1548

SHA1
a759f0d32988784d8da12ff41e40595f0ea0da46

SHA256
a20300e2ad435899657b6b20a630307e47d0b20ceed764be54bafbdffb6d0922

SHA512
16251e916cd09d668ce4f82c5dc02de70cad60b7c3c08bbe3c8b4e73bd62d8a0c737dd16b433b33c2d635f42a50e39e2c69f6bbe9b743524f257b72c53e5a42f

Download Submit
/data/data/lansa.sis722.sers/files/lansa.sis722.sers

Filesize
256B

MD5
af0eb8d807fb96bde7b272ba365c6a95

SHA1
15b9e0101f67ca1999fdaff9fc5a57e61c9b4ce2

SHA256
021541b4d941b4c2aef329f1b16c610f51c2026ca433ef6b3e401647ada36c28

SHA512
69446aea9b8e74248090f75b06bce42b361c59dc5d5353ba1e637be74e9f95af09e7433c556e47cf852fbff745c64f2ccd06e324f500bb10d6d8f459e28731e2

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a6a8280b4d774cbe67ab949845583932

SHA1
a8f8ba8fbbc6b96eb929396fa46b7dd9181c62c5

SHA256
2182ad61af71748e6094da21ce49b1f2869a8624596bbf77079c6547c2cccad2

SHA512
62ece1d794528cc852e22be71faba265ca1c49da7eb513e299bbf9eda53393ce7c2253b044028fa572a3ad526f4993e4666983b06d8c714768978a6cffc07a80

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
a49ee2d376fb59e2ed3ac57f8e0b54bb

SHA1
1dfa6c5ae2ba2fa9a9a513e38e62148adc84a289

SHA256
33e210e9c2ee4daaabfcf772aaea1c9428c49e11d33dfd8b2ef2c2e4cabbf6b8

SHA512
4458ef3c79115cca30fb250e3d3532627f217666a81f1d0255ea8fb37e50364f3085a7dd9f9b19d4393eb0f28aef98dfc6c8e7be18adeb1d1759886808a57529

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
94130d6004b4701b6c0d8a560e976711

SHA1
6ea1b073f648bfc9b7f8cdc0ee71ef47bc8b7fa6

SHA256
704b00708a639f5b7cdb3d9a0977994cbac6edb684629b7325636c648376c239

SHA512
561795db49c25e47b338d41fdbaf82001f63814d4b65e6666ea23632ae0eb01bb81a7d99dfe284c3a1a614a7a64f6be4f37cae873966da66f17e722363497f4d

Download Submit
/data/data/lansa.sis722.sers/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
896713099792f61833254c23a61f54d1

SHA1
382109367a784d37e3a68dc9b48cd2f72f06b5a0

SHA256
0154da4762380fb88f33385949273de56999ce61200188bb6a0c67c4fa1a2783

SHA512
8756e59b1b48bc99e67ec30b277b1723b697f0a6b8a47df922c49bca59c4c3df8c92f8b3918726569843c5e0697de23dc81e4dd542bb608f9c75636b048b872f

Download Submit
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json

Filesize
10.9MB

MD5
35d4cda95e19e9be467673c78e1e2fa2

SHA1
3868d4dda794c360f57ba650c332b39ce5c68d8e

SHA256
6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746

SHA512
577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7

Download Submit
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes2.dex

Filesize
308KB

MD5
5e58845043089ee3b37392fec0f23992

SHA1
5e8290a1e9b734ae423aaa5f49bef8041545ebbc

SHA256
ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba

SHA512
84387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3

Download Submit
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes3.dex

Filesize
265KB

MD5
cc92d248d0c568e5351842d103bce7a9

SHA1
1d4950fe500f0789ca77fa4858ab8ebc3cb2441f

SHA256
0201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d

SHA512
a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7

Download Submit
/data/user/0/lansa.sis722.sers/app_dawn/ZldSO.json!classes4.dex

Filesize
1.7MB

MD5
30465152db261852e3a226a666ec4304

SHA1
442a188e07db85653022734d0a8537d4312aef38

SHA256
c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4

SHA512
3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63

Download Submit
/storage/emulated/0/Android/data/lansa.sis722.sers/cache/logs/log.txt

Filesize
83B

MD5
b563758916de5dd5c9f32dc166d9cfe3

SHA1
e0a1efbb700c6d2577c89c0829404fc45cae56d3

SHA256
51cbf512e6f8874ea304836fa48a179dcd66a9d1fa027f4616c0d81996cd96ca

SHA512
f15be7b410dda964da59bd930ab11190d853ceb32fa2c53073df02765ac3e465e3a1ea871691a4d6e885665806acffb26470879f3deae676aaec9e35c50a32bf

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads