trickmo | 16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07

Analysis

max time kernel
15s
max time network
29s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07.apk
Size

7.2MB
MD5

9426cc5ac88d93aa4453a4dad3a3e707
SHA1

54b24c5bd029e111635fee3030c8271e706709a3
SHA256

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
SHA512

15904ff60802ec1d88ca759b3bc21aa4ae2c18514992f9482d7fe321f5b66db05e36bd659255e76f42ac9ec2d20c6e853560d7f891aaa824554be4d7f08a431a
SSDEEP

196608:jWbdzLLW2X11knMvQbhLi3K+JvZCeJ5bjn/0+57L:SbZW2l1kMmT+TCeJ1Qq

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json	4401	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex	4401	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex	4401	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex	4401	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json	4375	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex	4375	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex	4375	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex	4375	hinjohn.dad249.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hinjohn.dad249.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hinjohn.dad249.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hinjohn.dad249.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	hinjohn.dad249.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hinjohn.dad249.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	hinjohn.dad249.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hinjohn.dad249.ta

hinjohn.dad249.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4375
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4401

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
6d0994a4c2ae2198f5145013f0524f87

SHA1
a6660852b6899365e05494d5cdfbdeb608ab3a56

SHA256
b8b100ea092f4392a6f9bc8ee3a07b2d4dfd222c631bd7ba9562aeca3889e658

SHA512
45727771753312e65bc9d0218f0f09c78011cf92b46e1b4a676f32ddafa21f789286117d89d6c74aaa798931e609fb1efa8d884768c36d6b9cef1dd2d4738fd2

Download Submit
/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
576e16d3d41210cd4307a252035dd9d8

SHA1
a409decace5e183c7e88ea0737f5fe9849c9e4ef

SHA256
37d8c8c9193e9449b69bfc0351ea71353bd16d532faf6862b0f51c2e3cd3f9aa

SHA512
a93afec97a9e3cd1a34267cced151092208ca2df6d07957403c82c8c17384e244a3f05759d16b203098939a6cda8515201eb67208dd6c8a38031166cc11c83b8

Download Submit
/data/data/hinjohn.dad249.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
512B

MD5
de38fe5ca592f762568c96fef67fff08

SHA1
44baf63b3f245f8ce0e76981ec44d650768f2f13

SHA256
d3faa00c040510c41c2e3db04b13e1672e2852d9db54ef8133f1f93862fb63c8

SHA512
8f86a730838b5bc69102d0d8f2cd460f152ebb9b88575180715fa1c244e4d92577f0321ce051b1748f46381e0ef704b77ecc9c71f7f6d69720509c8e640afcd3

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-wal

Filesize
32KB

MD5
ece1d49784f5e49716d83e86e2892b52

SHA1
8843294a47158cc2adff218d9632c41bfd1c2643

SHA256
d0184fdf6725167f7b6a23a89ac090f4ef6e99541a7e5d9d639738d8d9666b6e

SHA512
2942f631824c4859e0aee7cac621b959472fba71ae611a278e14741668dd616c175f4eee9647eb6d0fd53151df1fd6fb09ace800f3bd18a43a5baea33d377aed

Download Submit
/data/data/hinjohn.dad249.ta/files/hinjohn.dad249.ta

Filesize
256B

MD5
091cc231cf0dd218ed16ab30395af645

SHA1
3e4334992796064cb46eb73050b0900d744695c7

SHA256
d9b89499996a26344b0fde42bfadaf700d64e5c54ad652e0d230f8f712a4c472

SHA512
2dca9b5e629841ecdaec621c8b8a4e8d3ec7aa01bc02ab8afc3e10259c2693db62398916591eb59c05c0907129ad8f97519d37f9a116f651f3d2850eac60b1c3

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
af3c840a69fc4314d36c0b023299a139

SHA1
a72a2e65aec98c8aef9b8d6c84a158014d50b031

SHA256
a58a78afc5e89109509f8e20c715c7de84a411f054ca94f66083330e3f380271

SHA512
2acc915c14bc473ffee1b4d978aad5e230015197693cb25eb789de3d338ab2d8e15a961f11927dbfbd86c1d19c094a152b2f06fb4b2dde839fcf45438607ffdf

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f580013be1656a8045bd517e6d82f339

SHA1
6ff601a6e3010d5e2109b584f6714c15479da4df

SHA256
ccf9819fc4ba3c892f71d34095ac2aca44b7f73f0070c372a02f902c598b2998

SHA512
6ce2285c8556b2c2234c36c31a478e637ce3cae5939d99c565001ac0460aecbf4438a0bbe42dc65a23b2f01f9ed2aa86af998d686216f7fcb12ab1f45b420f74

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
16981b011029a24b03a7d4484a1d1ee1

SHA1
3972955a197c81304f2a4e43bb07c24ca8eec44a

SHA256
e20a9326c7fced3d8689db912122cca0057cd51530e739f90a44ec9e073a78bc

SHA512
9aca6474839c9974389bf9d280319ef9c637b6220c5c9d55c23a70f7e37b83a27badb128f9393b3b0f26d3bad74ffdac99ee2ea207604dd8cf876ba84e55c67f

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d98d2826d57f0ccc7fc29e187b68b565

SHA1
6637bab8c39caacfd7abdeb5177a9febb6c728b9

SHA256
68796a772581ff9e272367f0a182ab44dbdf310bbe7a4570c76e09084220e155

SHA512
f2c2bb759ec90d29bb7b3618a92557237228b9431a2578c70fdeddef20a78cd2a127da89587339757af8bc945f837a2b4ce371544eccb8fae6bfb49e5402bf48

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex

Filesize
351KB

MD5
5a6c21c97564f9a1e87f8d7f10c4a768

SHA1
1e5f3c0425f58d762043761315dbe272245a6be6

SHA256
0560c1387efd41865f075e176b7d4875340db043d943c95f0ad11f0f684fc519

SHA512
e823cfa4c5dd345e9f68aeeac384d42797ed1419eb70ea99d122a6c20a066a97fb94ce7dd6037b743d82eaa21bab2974213027c5e3a03af95c6c8ec513b7ec6b

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex

Filesize
257KB

MD5
b9c73c4d9fcf118ac64a47bdfb8bb561

SHA1
f74dec2bb9dc1c5050ad66937ecb844b915a06b9

SHA256
31b28132c9fac2f1062b7eeb45e2c281d65d19dc03805a7e4e4122fa492ffb1c

SHA512
750c57fa2798de21de00d20cd86cab0c12e4e7d5d3c8978f6c674fec404b6aacfa9b3bdf03d0da0f0bb16fd62928dc625e3ccb135699757bd16ec3e7e379d375

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/hinjohn.dad249.ta/cache/logs/log.txt

Filesize
83B

MD5
eeea423eefa6a46c0221d8e612668ccf

SHA1
8ee945832c54e28a9f6d2ccc7790c7704ead6d74

SHA256
1bd33c8b84196620c0b41e033f81774ae79ac58da8e0741196498ed2d3cc3fe3

SHA512
610239fae22ad697f4b87f1d69ce834dd9c423b414a91484e999b446ead6ee8848dc928b9fbfe6371ecdaea93bd7fe99e2b2134746948c9fe579d7c0197acc28

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads