trickmo | 16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07

Analysis

max time kernel
126s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22/03/2025, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07.apk
Size

7.2MB
MD5

9426cc5ac88d93aa4453a4dad3a3e707
SHA1

54b24c5bd029e111635fee3030c8271e706709a3
SHA256

16019bccb869e2c1db792b41955b14c6a0ffe4f3dda0d44c077c75e230040e07
SHA512

15904ff60802ec1d88ca759b3bc21aa4ae2c18514992f9482d7fe321f5b66db05e36bd659255e76f42ac9ec2d20c6e853560d7f891aaa824554be4d7f08a431a
SSDEEP

196608:jWbdzLLW2X11knMvQbhLi3K+JvZCeJ5bjn/0+57L:SbZW2l1kMmT+TCeJ1Qq

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json	5059	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex	5059	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex	5059	hinjohn.dad249.ta
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex	5059	hinjohn.dad249.ta

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hinjohn.dad249.ta

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	hinjohn.dad249.ta

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hinjohn.dad249.ta

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hinjohn.dad249.ta

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	hinjohn.dad249.ta

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hinjohn.dad249.ta

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	hinjohn.dad249.ta

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hinjohn.dad249.ta

hinjohn.dad249.ta
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5059

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
6d0994a4c2ae2198f5145013f0524f87

SHA1
a6660852b6899365e05494d5cdfbdeb608ab3a56

SHA256
b8b100ea092f4392a6f9bc8ee3a07b2d4dfd222c631bd7ba9562aeca3889e658

SHA512
45727771753312e65bc9d0218f0f09c78011cf92b46e1b4a676f32ddafa21f789286117d89d6c74aaa798931e609fb1efa8d884768c36d6b9cef1dd2d4738fd2

Download Submit
/data/data/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
5.2MB

MD5
576e16d3d41210cd4307a252035dd9d8

SHA1
a409decace5e183c7e88ea0737f5fe9849c9e4ef

SHA256
37d8c8c9193e9449b69bfc0351ea71353bd16d532faf6862b0f51c2e3cd3f9aa

SHA512
a93afec97a9e3cd1a34267cced151092208ca2df6d07957403c82c8c17384e244a3f05759d16b203098939a6cda8515201eb67208dd6c8a38031166cc11c83b8

Download Submit
/data/data/hinjohn.dad249.ta/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/hinjohn.dad249.ta/databases/a

Filesize
20KB

MD5
93e7f88ba7fd4f0152e8e5dc56f1acc0

SHA1
f29883585567a32fe4d487e5df14173c39c09e65

SHA256
dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c

SHA512
be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
512B

MD5
3a9e647a12147780e3f4a67a0612e483

SHA1
6cf957f4f547debe929cb9118b72f0f7b5d5dc70

SHA256
0d9453948ee1a50982492a75007712520e7e5bd65b31ba0b7bf62a13ea9c29eb

SHA512
ef26d342a4b1e1f71ca615b7036e64330e6812b5225be8c4b446a5e2cd2bebb7125a97650b39b2f69c6762c9d5da42baf0d8ec21ebb4860e9b33dc32839b50ea

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
8KB

MD5
3b70012a7654141402b9dbc7c4b2f078

SHA1
4bf15a01d1229add6ee2ec84f94622f7d62e2110

SHA256
fbfc32c6189331ff32673d8388f442c44e3f701946a82ba1955c9df913f90b6d

SHA512
4073ee5d243ed66d3ae03c3928bbfa69749beef4a298f25e39bc8c7fcd589d69103049ac050dbb9c94440359a145433baaee0e88ce77103bfb4cad2d05afa51c

Download Submit
/data/data/hinjohn.dad249.ta/databases/a-journal

Filesize
8KB

MD5
c591d584cb954552407c05d432ccc32d

SHA1
2e73df92f83aabf5cbf4f9fbe25830030d1fa278

SHA256
e52451e36592a0d839b1af7c24843023e785f18a3fb4bcf9bcd14cb83f0c3ca6

SHA512
cc52b66e0b516d1acbcb9c82edc311e023ee2a351058e7cdc8597cfb4103f2e3af50d15570fc52667a05392f416a5f6008912ed18044a58d45deffcdcf72f778

Download Submit
/data/data/hinjohn.dad249.ta/files/hinjohn.dad249.ta

Filesize
256B

MD5
2fe756f9b31491dff6fb4b06e57424f8

SHA1
afa0152d01c9b242853eb9a4c6ab5131b7aee17f

SHA256
1933a61d6e64ef030e277d958429b3dcdfe2cf5ca2b651af0ded4663a02c6238

SHA512
486f0a073bec2a9fc4b58294c8b2f7592f84fe3aa4b5b7e5f91be270fd3bde237521be979bf7a6e6148757709d5ab49c64d520c92b3332df727c5d0f54a68c20

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d33aea8310e9e4da093d1c4ad5891683

SHA1
615cc36d5ed1fb83a8e196634600e79ae936d77d

SHA256
651993627f6c8bf5b839eae2cc0574c2e544a01f68567f1932fa301062f9f62d

SHA512
0aa6125850f1ce2d8b9815c6d6582fc9a1660d1f39b71ae371297861db8875a72fab5ce79da06082ce49cc2fc33d98deb665eb7e0a2777e4832460a6dddbc491

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
36f352dd73142c50721a5d1088213f94

SHA1
ee09877af2445ac9dc32db022130e52ded4b154d

SHA256
07f595ab5b3baa9f8012ebade5bbcb6297c192978de079ac4e5899655bb4469b

SHA512
762c2f4af636c04a4fee21cc3c481c47b5fefa25b3930c32e731a488f28d177c9af159b6b11debebc44d647c3bc426631df651454208ac4a2b9a12aad169a23f

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
668953f3ce092c3213ff7990a20abb97

SHA1
cd57369c3921bb7823e9389e0b57b4b69c20d866

SHA256
af586a402792f22e4946943d2c17a94e9355ab798106f81d19a5d7afc6eaee44

SHA512
79acb6f4a6211d428d05f3e6ec2bc0a460d35cc8edadb40d7420646e18c2675e4a948f79da9ee029892631b792c5215a107fcb3451618bc9e821c6136cfb391a

Download Submit
/data/data/hinjohn.dad249.ta/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
159fe28bbf3397eb374c50a81c40ea0a

SHA1
c3a681629ab5d60ef325a50c2b22b6fe864445f5

SHA256
2077d46c51abaa05040e068b6df995646e8e2ff5deb857d50dcec406555c6063

SHA512
5544f2d6990607c690dd7d92594876bc4371fc871fc87fa745288e4a4f49cad43cb09c9ef7249e36dbb60bd70bee32651ea38992c0a67b0f460972b331ee7874

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes2.dex

Filesize
351KB

MD5
5a6c21c97564f9a1e87f8d7f10c4a768

SHA1
1e5f3c0425f58d762043761315dbe272245a6be6

SHA256
0560c1387efd41865f075e176b7d4875340db043d943c95f0ad11f0f684fc519

SHA512
e823cfa4c5dd345e9f68aeeac384d42797ed1419eb70ea99d122a6c20a066a97fb94ce7dd6037b743d82eaa21bab2974213027c5e3a03af95c6c8ec513b7ec6b

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes3.dex

Filesize
257KB

MD5
b9c73c4d9fcf118ac64a47bdfb8bb561

SHA1
f74dec2bb9dc1c5050ad66937ecb844b915a06b9

SHA256
31b28132c9fac2f1062b7eeb45e2c281d65d19dc03805a7e4e4122fa492ffb1c

SHA512
750c57fa2798de21de00d20cd86cab0c12e4e7d5d3c8978f6c674fec404b6aacfa9b3bdf03d0da0f0bb16fd62928dc625e3ccb135699757bd16ec3e7e379d375

Download Submit
/data/user/0/hinjohn.dad249.ta/app_praise/AxpFCZ.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/hinjohn.dad249.ta/cache/logs/log.txt

Filesize
83B

MD5
36cbeef11770971994d4ba3cf41a5cb4

SHA1
6ffab12db8f918aa5618fff14b31145c884ec826

SHA256
660d4ae3a580efb773402619e3067097eefde5491c974185661fd8061473d599

SHA512
ddcb0426f6fc51d20f88fd2e835a9b9c276907e2948fb026e71c3b65955c9e89e09554e62fb2a07054207c9fb07f43eae60072aab14a7f4ad408754560d96f74

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads