trickmo | 16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07

Analysis

max time kernel
126s
max time network
149s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07.apk
Size

7.2MB
MD5

9426cc5ac88d93aa4453a4dad3a3e707
SHA1

54b24c5bd029e111635fee3030c8271e706709a3
SHA256

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
SHA512

15904ff60802ec1d88ca759b3bc21aa4ae2c18514992f9482d7fe321f5b66db05e36bd659255e76f42ac9ec2d20c6e853560d7f891aaa824554be4d7f08a431a
SSDEEP

196608:jWbdzLLW2X11knMvQbhLi3K+JvZCeJ5bjn/0+57L:SbZW2l1kMmT+TCeJ1Qq

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex	4364	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json	4337	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex	4337	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex	4337	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex	4337	hinjohn.dad249.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hinjohn.dad249.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hinjohn.dad249.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hinjohn.dad249.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	hinjohn.dad249.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hinjohn.dad249.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	hinjohn.dad249.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hinjohn.dad249.ta

hinjohn.dad249.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4337
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/hinjohn.dad249.ta/app_praise/oat/x86/AxpFCZ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4364

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
6d0994a4c2ae2198f5145013f0524f87

SHA1
a6660852b6899365e05494d5cdfbdeb608ab3a56

SHA256
b8b100ea092f4392a6f9bc8ee3a07b2d4dfd222c631bd7ba9562aeca3889e658

SHA512
45727771753312e65bc9d0218f0f09c78011cf92b46e1b4a676f32ddafa21f789286117d89d6c74aaa798931e609fb1efa8d884768c36d6b9cef1dd2d4738fd2

Download Submit
/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
576e16d3d41210cd4307a252035dd9d8

SHA1
a409decace5e183c7e88ea0737f5fe9849c9e4ef

SHA256
37d8c8c9193e9449b69bfc0351ea71353bd16d532faf6862b0f51c2e3cd3f9aa

SHA512
a93afec97a9e3cd1a34267cced151092208ca2df6d07957403c82c8c17384e244a3f05759d16b203098939a6cda8515201eb67208dd6c8a38031166cc11c83b8

Download Submit
/data/data/hinjohn.dad249.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
512B

MD5
15fe41689c00c1af9d16d3d0bb8083ba

SHA1
93779d80882921cc03790c22a4ee80acef3b9760

SHA256
2fff22527e814511190336f22cebe7bb19305c66342c4d8665bfd0e740f4e5d7

SHA512
3d3a9983028de3bc7b24f509e3b04e5ef180efc59b1e30b7f2d83ac228cc6607912ada2ff271512eb16df3bdad85ef4889b3487f1db0fbdac5c59acd96286614

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-wal

Filesize
32KB

MD5
3d9a35c400d7e3415fc04d9bb7801ba0

SHA1
5bdb343d083d6bdf4af322787d3be6e977194b4f

SHA256
81ca3a6019b3b13a56d2ce23fd3dc450eb74e5ac942e107b9038e288ffb9330b

SHA512
6ece7e70970a6bd309481c68a1c21af26739ae709fbd4d48ae8094b369b8a85dab5313c0d1434885895d03dabd72b423a41820f302f0deed8f5d462eac9f21b8

Download Submit
/data/data/hinjohn.dad249.ta/files/hinjohn.dad249.ta

Filesize
256B

MD5
c2c7f92bb8dfed9472ab7fe703b60ae8

SHA1
c9ef0e9db4b3946b2e8181c92661c5709b86a763

SHA256
c30d35c58b8eae904d5acf102ffc6353359c13b743ea63ced1e58190fdb0b1a0

SHA512
cd564ab96b49799c11331dff251abe5669336941d7a1c9b9a7ec14de99bc024500364ee63301f4c3cc5fe6505cbde821c2efa2bcf9c22ce03eeb73b75aa4b109

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
6ae2b4652bb6ffbd1901f20ca0121415

SHA1
fde16dedd570ebd5d80c4728513235722152bcb6

SHA256
af15a054dd2e7e79540f2ba47791e66e80752ec1c95f85a9d43daa6f1c1e9cad

SHA512
73f282ee81273f4bbb44ce4647ee0936ac3f1bbf0f35e5596d54d1460c4b49c5abfa866bf9c2cf3b4c3eddfa14e5ee819b86953ee072b181defe3647218cbb06

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
90d77aa7261889e57ac8e07076fed0ad

SHA1
e296697cc2122114d1a599da36aca85bcf3d4017

SHA256
b441273a6ae5f93ee4bbd3897609db796696b345b25e42114ab005985d002e0e

SHA512
030e480f159766bbc401c5a26e694300581af80e7b47b0f4cd090480ed3d003393f7002cf2e549bfccf34db76e73a7af1e59341686ecbc3e64a519864712d83f

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ff6bd7aca46545e29a662feb267e49fa

SHA1
bd2039ca34c0e74fb538a3d0a851fd46b907cc51

SHA256
86870ec7f0102fa3e6c2c5c0aeaede1e57b99614e5b51580bb1c6a8960660d88

SHA512
9f159f4a82e98c4a89a4f7abc2434033dfffcacc5dc6e9c034a8a0e9bdd987c4c61b44c2ac5b7ff00b225c72792e633815b30ca0323c2580e875f220bc048abb

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
83d35bb1bb1720b3765244ad574bac82

SHA1
899a6839c564855ed4d0155047e22687a5f7e39e

SHA256
506a8008f21b3f1a602f06b69b2363a85890bcbee56621c42ea3b042f1b83ca4

SHA512
03ad483f6d1f1f4b660b20e13ddc4599151975db63534e7ac592d90242bc044cdd5f5667d4631aa081e8f7acc36dbc943b60e56e0bea47d0bf8cdf4f473eac59

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex

Filesize
351KB

MD5
5a6c21c97564f9a1e87f8d7f10c4a768

SHA1
1e5f3c0425f58d762043761315dbe272245a6be6

SHA256
0560c1387efd41865f075e176b7d4875340db043d943c95f0ad11f0f684fc519

SHA512
e823cfa4c5dd345e9f68aeeac384d42797ed1419eb70ea99d122a6c20a066a97fb94ce7dd6037b743d82eaa21bab2974213027c5e3a03af95c6c8ec513b7ec6b

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex

Filesize
257KB

MD5
b9c73c4d9fcf118ac64a47bdfb8bb561

SHA1
f74dec2bb9dc1c5050ad66937ecb844b915a06b9

SHA256
31b28132c9fac2f1062b7eeb45e2c281d65d19dc03805a7e4e4122fa492ffb1c

SHA512
750c57fa2798de21de00d20cd86cab0c12e4e7d5d3c8978f6c674fec404b6aacfa9b3bdf03d0da0f0bb16fd62928dc625e3ccb135699757bd16ec3e7e379d375

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/hinjohn.dad249.ta/cache/logs/log.txt

Filesize
83B

MD5
36cbeef11770971994d4ba3cf41a5cb4

SHA1
6ffab12db8f918aa5618fff14b31145c884ec826

SHA256
660d4ae3a580efb773402619e3067097eefde5491c974185661fd8061473d599

SHA512
ddcb0426f6fc51d20f88fd2e835a9b9c276907e2948fb026e71c3b65955c9e89e09554e62fb2a07054207c9fb07f43eae60072aab14a7f4ad408754560d96f74

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads