Analysis
-
max time kernel
126s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:15
General
-
Target
deper.apk
-
Size
6.8MB
-
MD5
fb036e22c765cf7dfa625b25ed43b520
-
SHA1
bf36e7998e76f1b6d64b833fce4e2fbd2df67621
-
SHA256
0f0f6a50d4d96be437251a0029aebb34b53fdf4b3adb838dcffd217bd657e6d3
-
SHA512
aad2051941c707d8cbd2f2e26000d1835f11cc5ae503776213ca4e81c8d96c9fb0acbee0d46ddd3a687ef2ab8cd37df062500d29270519d27a4f60ad51c5d135
-
SSDEEP
196608:84NS+koOTZwleubHrPlCDruIexT2FDuxgey:5NpOissrlCvuIexiqxgey
Malware Config
Extracted
trickmo
http://traktortany.org/c
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
lansa.sis722.sers1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5c061bae620d91be24cb526c28bd172f0
SHA15b7d9ca0978aa2ecbddac34adbc1366d346298fb
SHA2568677bdce1bfa345d8d393ffd9b4495d0f11916c3e8b78e3c3a0e869fb1f50b26
SHA5127cabc200ca22bc0285a424ff8ba7a974ddcc86e0d7049e02b0f0819f141f4b31f6eabcfc55725c493c511caeace038bda82c3f271fae068020bdd5797525efe4
-
Filesize
4.9MB
MD57de90707f33dcd6b4c16c5030a7cb478
SHA1007c067a2a164d68b2a82eeb19fcaaa3633e0c1b
SHA2567d4b7850eba8e805a62f8de97fd8bf60e61d2da62425c34ae80adc635a3053f6
SHA5128370bba49ca500788beeacf0e895a103b9010db3b4de3098993853c70f2726a9615ec9f560ab8cc5eac01f7e196f834d04da31eb64029b552b590fcc59f5f5b1
-
Filesize
20KB
MD5e48ae2e98ea5b39dd12819b5cceb7dc3
SHA1219af8ebe9bb26b76eaa53356a613e5fbb806dea
SHA2566e954b8f3df47f2444f1877d8b714e7baa19a1fa4eeca749943eadee1661eac9
SHA512443960bd2d2d0c9a57fd5d2bd75d7efe78071ece69f020260065ae0fffae70e5559c31476156fff62b7f24f4e72b953885a0ea1a858d9205d658e9738bb181a1
-
Filesize
20KB
MD557baf3e42a94e8dd82e267b2f0619330
SHA176512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA25649a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
SHA512227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
-
Filesize
512B
MD58ab8efece898043a53a2f7128e378a99
SHA11efcdce2935883eaadd37a0be0a3efa104c7fe51
SHA256b96292078235682c51aee3c2e539baf4a2497d9d2775f24d7c63eb8fff0d9417
SHA51280e39495d113706dbedf5ab67ce4793b23a2d5b3f7061050ae5fcbef42853e25406e7db48a460255e83c979139faa27a768be59012e2c9682e069f51e46418ac
-
Filesize
8KB
MD50e4dce23a7e479d5fef809bad2e0acf7
SHA1f26dc25016c91bf4f07d5f1e33b487180449da3c
SHA256eaaf2dba3c0090e38edbeea66b5aed93ba403c3b0666d9576841083ce894a440
SHA5128639c3947d2caa3f22e210db2f83504b9df37b1f946d9b500f6ddf3ef77c08cec9fa2f215a50487549716b11728b047f45493a5c401722ae5617755c103d999d
-
Filesize
8KB
MD5181975451c99edee0d7ffada37945d66
SHA10809ccdb0778aaafbf3222ba1dd8b59c5ac85035
SHA256adae2211127bc01c1398f6c02b79a048cd2731fc3a6ba6b9804987bd23128e33
SHA51251a5df0fdb516e97677b2d4f7d4e9bc88aa39e6423e33a650b9ce69e01ed7ab73b990924cba152fbc7201e101995995be3d804708bab247cd9dd7d3cfdb22869
-
Filesize
256B
MD58ba105d1412bf2bd7d265609deedf41b
SHA1cbc577ee4c7d0e76e6d8ae03b6b04518a872d8b9
SHA256b82b8c846897c6b70f899598b87501bb08d0c000d43aca88d4132caf9ccf7dd2
SHA512214eb4e93718d131c444c6f6cdeb389312a558dbe027f5bf2c9fdfacd140467b235d6f7ca858f074e87724936557e2412cc9a81c95aff2446db7c0c4798716b3
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD513a4fc1dd917cbf9d545914635f34312
SHA18ef9aad15a0f2a271efd810a9ef91fdaf8b53cc9
SHA2568fad3fc908aef40afea5879e3e1f602b0edb7e69656279bc968dac19b223ac4d
SHA51299d9757b0b2f02a5d7d6f529800dcd38654c9c6dd9fc2e2241d7265c325d4b324112366ce1aea99aac98d32e59ebb6005e5e2cb4dbd13e27b4552fb00c01f5ea
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
173KB
MD560ea6a21dfa880806270b69706348916
SHA16249e506d77d118cf8f34cd98a40c74e15a2ef0a
SHA256d5475148e6031efb64b1526a1d041e07d06d31fd7f9ab5e3db8bb0564bd7ea3c
SHA51258b89853d39c26c285eb7a638d12eaf5907de401ffe62c30bf726b980e02418fa4d01744a883668deb79f6447232455aa4e9e41856c5545341109209f12cbe87
-
Filesize
16KB
MD5d2c07c50dd3a82c1049e8178e162496d
SHA1b02afc5315d59bcc30a963bdf2984283206637e3
SHA256fe67d92f1de124a4eb9d0323c67fdf4f6a59d922094e4b0f49a1d07c53aa0189
SHA512400de127d3ec20c45c6ce429ca2e7c2295c2abbcda847ed68c741ae683223846e00ceae7279d8a9b4f5dd7a82367ab35ad1c3fd2566e7b746ebe21707fdc11df
-
Filesize
108KB
MD53fd5055eb96024e97ab8827c29a8d01a
SHA19e97a4297138c330ac846e7284feecb0ea6df14c
SHA256ae1fb3a9bf9fff6a485c0b385ce5f5a1ec36ed8f0f13a57032cf5d1116baae6a
SHA512c4756229721ce130c1e955f803508a862795076b9abbdd727bb72331dca3ee375aaff263baaa98088f3f4ce77b3a1d524423d959a7787a6ed2a4047eef9c5ed4
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD55e58845043089ee3b37392fec0f23992
SHA15e8290a1e9b734ae423aaa5f49bef8041545ebbc
SHA256ad60aece05f500cada31b766831e2fa87aaf6fba58b9dca20c9152f16605faba
SHA51284387a9add5b7ea6220ecfab5773b62d9d0db6ebce799f5a090817a04d0862158e1acafccabbe99bc2dc7abb30b5ade111bd6b4769ef929f3d57e962bcb656a3
-
Filesize
265KB
MD5cc92d248d0c568e5351842d103bce7a9
SHA11d4950fe500f0789ca77fa4858ab8ebc3cb2441f
SHA2560201c5566b578cf5ec8237dc7970a5a3b63afd2e035d8e94ee82230c8a2a691d
SHA512a49aa848d7544e20d33de320faf7169c82669438394d861814fb832d8984fafe86c955484654d55cff7d5ff45e0c60d09b7b6e7c4602ef8ef312c0cafbacdfa7
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5b563758916de5dd5c9f32dc166d9cfe3
SHA1e0a1efbb700c6d2577c89c0829404fc45cae56d3
SHA25651cbf512e6f8874ea304836fa48a179dcd66a9d1fa027f4616c0d81996cd96ca
SHA512f15be7b410dda964da59bd930ab11190d853ceb32fa2c53073df02765ac3e465e3a1ea871691a4d6e885665806acffb26470879f3deae676aaec9e35c50a32bf