Analysis
-
max time kernel
25s -
max time network
30s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
22/03/2025, 00:36
General
-
Target
deper.apk
-
Size
8.1MB
-
MD5
2240488b9d8e26e7a7c5d76a915b08d0
-
SHA1
9484cc97cbd0538fe759e8d6f500b94df0c15ba5
-
SHA256
882a8aad8dcb9ec62e374a03553c5a7f2f0cc6db66050ca444e8d47d3d1838db
-
SHA512
5fd447c6a1584c9155366e806423caf37412ceedaaf5f84ae122d76c81fc8801a1fec86990554fe2ddbb33c0a7e76c89c2f48f83013e2de1d6a9ea4f60352bad
-
SSDEEP
196608:cpOsHIcaddwITP6wUAfm122Jl/aPkJ7wspYVoMW/:cpOA25SwUAuMZP87BquH
Malware Config
Extracted
trickmo
http://somakeawish.com/hpuex9yu0lfad7pjoxcl
Signatures
-
TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
-
Trickmo family
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
kegvi.nfec906.cyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5dc5e64e81f6c94ea3309f8b4b295762a
SHA1e5fae8b8752ebc5a19c1c80d3dfaf0016e34588f
SHA2563ab4a086e362bc3167b70df96b2e58f925464484668b8125d5452f816c021ed2
SHA512090196b47bbaed67f0bf35a085d053c55c74383c49fed25d7fe716c5420b91247d762083c3cac926365b264de289d326c7b5e9a87b5a2d73f857c2041a9d22b8
-
Filesize
4.9MB
MD5acf53beb76bdf09e622f959c2883788d
SHA18326e8dc4ed0201ea2f2419b2926b1247fea81f3
SHA256fc045b73ff077d2f4548ddd57619ff8681e229e7ad8dfb0179f79dd931a8f187
SHA5120bfc3baac38049bc1d7f34b2a34202670c3e6b8a8e116f26bb894b5cf1f3cf8892b5b832cdf1218e0afdb0f6cb3410ed126b003dcbbbdc88c52926b2cc86613a
-
Filesize
20KB
MD52a08aa3691d360c2ff0815d0b7812fde
SHA150c37f212fd78fb89ecb00f81656723ef28fd53f
SHA256ec0eacdcb736f245853bb430a97dfcd3dbf0e6abf43733470db53fbebcdd0e2c
SHA512d9243b6ea042f3d0014ecd1f1afc1e71e9da1fca40f36d3a3e0bcdcb91badc7e892a2944c994a267ad3efdd94e78c17db9afd461d2858d189f4b42c622897b89
-
Filesize
512B
MD59908bb4c1cb4df56095f198bd07da121
SHA1794dd4eba3c993dd6957e153446a51a2c0255b15
SHA256b41908c4dee64c586b8a559d140b95b973d1cff9aaeb4b5c3dc6617a25aa2f64
SHA5126a8849006d30ffe0c9fa29a00ecdf26d537c7f822dadcaeca81c6aff3fb42d49f5077870a64f30ee7d2ebcb3f8508a645b91c2d0abea7c3439508808f65a1d61
-
Filesize
32KB
MD53bbd3a27f6d8c8b453b81e83a2f76985
SHA104db035cca2fffd3a34c088c2ed7a0725cc1792d
SHA25663c09615bd5a83fc0a739385284d59fcc88ecd3c20da59af2f372b432289b2fb
SHA512c6fd0cfa58501eb22e459631a99f8d7b63d005ef59e06420fd6ecb2d1468e5bbbfb7d2c81f1cebd765d05fff0ab84676bd62e598b7b13742ef1cef78f276a224
-
Filesize
256B
MD53826a4048fc670981780611f6c47c077
SHA157d99eb142813b18fb88255904069fbb0da01040
SHA256b9b216b6b5305ea4463a945d8a9a9922d3a8901713047697da239206cf0b7442
SHA51267ceaf676fc7b5dd6b50e8f2e331437d1492e49a543a5a9c1462766ed8f44ed496f2c4c13826b6b582d8a9d14cb0d51a0af738f01a9729aed41c46c4d3a2d57d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56518b7b25360b66c6c4535d68d1476ab
SHA15aa2ade41279c9397b74a874332ee1ebbdefa8d7
SHA256d067dcae542b53c62ae5f87ca44b30418bd1572595e89e867c0b42a8de897d34
SHA512d679a3d7f770f71d934dfbd682674f3f8dc3ded8b16e6ab969d3a796ffe0b41936b1364f89c3254605730e757743f3fa79cb5c07426f4efde8beb79259a18c3f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5fefb1f6392ac0c224f1c372c9a3e5d9d
SHA1e98bd1b8f02dfd36734114315325af78a27003e0
SHA25651090852571e32da0c3bd4f328e81b1d167736d701abc0ef78f3a181635ab542
SHA512644eb3331dee78f1892d8dd8c90451d55f6c887eff9f9881009ccef376240dc4fe7d86bc75966b550ee1ca98e2607fed1d224b8601b0a7bfe1ecf9358c56da64
-
Filesize
173KB
MD5ce43cbf1b126e8411843a989904914d0
SHA14c909c2da0567f79aa2c208af05c17a9b1a8bd2f
SHA25669daf5b791f61860a17dd3dbfa47772edccd721a8ec8cff942b5a77760f94d70
SHA51247a8c083d2d5e690c986f217571eaa94b2d615306616ebc266db0a1fbb2c520815c7d39d377a10dbeacd0a5e18b18594598b281e8868e4e9756b2708cd9effc6
-
Filesize
16KB
MD5f0aa6dd8d7baa1dae7d38c07763b7e68
SHA1c4bee1475a8c8972044763baf12e7997bf2a3430
SHA256bbbfa0c2a55fe4220050798623e8888b0295dd57df41297780bac04a20a69c0d
SHA5128a0fdb97104c8eedc18f5d7272b7c01dce8dbe58b05b45fe8d8d52ef8548979e6164c2e9fefdd77b324aa65d0152d6ddb61f83ac6f375ab2a7babbf30ed0032d
-
Filesize
10.9MB
MD535d4cda95e19e9be467673c78e1e2fa2
SHA13868d4dda794c360f57ba650c332b39ce5c68d8e
SHA2566c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
SHA512577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
-
Filesize
308KB
MD5c4f1bf1c779a21a25c3dbf5a15efedc5
SHA1e525c2e12234f6eca7690f2bf0e29ae48f958e33
SHA256410e18df84f39a134073269b355ae5e6473f689ed9bf3f9903a6eb38af2fcadd
SHA512ab612b7ef8de98b3943600cc39c26149e520ede008366a2efcf9d1e76e17ca53068c9f4699e6b5e40aa8f99b5339bc8e35091fb264bcf3ec640fbf68c465476a
-
Filesize
265KB
MD5c6abf8a6dbc7699cb23c034ae965fb05
SHA11a420d700e47d712acc84641fad51a4b40041cfe
SHA256c3cd0d23cf49de955c9bcd893cafb62ef3396c0e2d52b631eaf78726913bf958
SHA5129061fda1a71959cbfbf9effc673213c0678ef91b4958a4674c11e1ababcd433541f0298852b785cc66cff1c945816230309111127923ea21795ed2ad31ddb287
-
Filesize
1.7MB
MD530465152db261852e3a226a666ec4304
SHA1442a188e07db85653022734d0a8537d4312aef38
SHA256c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
SHA5123b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
-
Filesize
83B
MD5d5732b4db0a3749d7cc49422db72cb6a
SHA1d9c26c3fcda21d6db5c7283145b6d6672fa29cc1
SHA256e6d1713a27f9f13b1af6f30e809fb0e0d13500116368c1a633268eaf19951333
SHA51291a6160c799a60837c870ae100f1a1d7abd62017549aee30dfbbce70286f96cd39e05eb412db8fb3a4144c4d3a09138a3eb22100a562c4b14b00f974f9f60890