trickmo | 16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07 | Triage

Sharing

General

Target

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
Size

7.2MB
Sample

250322-ast3eaxqv7
MD5

9426cc5ac88d93aa4453a4dad3a3e707
SHA1

54b24c5bd029e111635fee3030c8271e706709a3
SHA256

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
SHA512

15904ff60802ec1d88ca759b3bc21aa4ae2c18514992f9482d7fe321f5b66db05e36bd659255e76f42ac9ec2d20c6e853560d7f891aaa824554be4d7f08a431a
SSDEEP

196608:jWbdzLLW2X11knMvQbhLi3K+JvZCeJ5bjn/0+57L:SbZW2l1kMmT+TCeJ1Qq

Score

10^/10

trickmo android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

C2

http://techpoint.cn.com/c

Targets

- Target
  
  16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
- Size
  
  7.2MB
- MD5
  
  9426cc5ac88d93aa4453a4dad3a3e707
- SHA1
  
  54b24c5bd029e111635fee3030c8271e706709a3
- SHA256
  
  16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
- SHA512
  
  15904ff60802ec1d88ca759b3bc21aa4ae2c18514992f9482d7fe321f5b66db05e36bd659255e76f42ac9ec2d20c6e853560d7f891aaa824554be4d7f08a431a
- SSDEEP
  
  196608:jWbdzLLW2X11knMvQbhLi3K+JvZCeJ5bjn/0+57L:SbZW2l1kMmT+TCeJ1Qq
Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Input Injection

Tasks

static1

behavioral1

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

behavioral2

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan