trickmo | 0b536b95b5a65c6f79546adc9c7ff0902019af1742b22fdbe4f4370b3089bc84

Analysis

max time kernel
91s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b536b95b5a65c6f79546adc9c7ff0902019af1742b22fdbe4f4370b3089bc84.apk
Size

8.0MB
MD5

090d40fa8f1a3550ebdfe3241872dc0e
SHA1

5c08a70b4e2fed4683fb49718a487e94b78acdb3
SHA256

0b536b95b5a65c6f79546adc9c7ff0902019af1742b22fdbe4f4370b3089bc84
SHA512

a0258167d857a5531dc052a0f31468c986e19dc445ee1a434d9887e20afd757ad25b8a8cb838661c29b174326e8171d5622dccfceb673919ec2cf61bf814a4f5
SSDEEP

196608:ZM1V0jsGDszhM9zSMI/bFa3mAAcFpYYXCTLWHozfkoHdQpz+:aK/ozhlMISxJSTLWo/i4

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://techpoint.cn.com/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/tibo.sa194.seatt/app_chest/uX.json	4355	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/tibo.sa194.seatt/app_chest/uX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/tibo.sa194.seatt/app_chest/oat/x86/uX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes2.dex	4355	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/tibo.sa194.seatt/app_chest/uX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/tibo.sa194.seatt/app_chest/oat/x86/uX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes3.dex	4355	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/tibo.sa194.seatt/app_chest/uX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/tibo.sa194.seatt/app_chest/oat/x86/uX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes4.dex	4355	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/tibo.sa194.seatt/app_chest/uX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/tibo.sa194.seatt/app_chest/oat/x86/uX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tibo.sa194.seatt/app_chest/uX.json	4330	tibo.sa194.seatt
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes2.dex	4330	tibo.sa194.seatt
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes3.dex	4330	tibo.sa194.seatt
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes4.dex	4330	tibo.sa194.seatt

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	tibo.sa194.seatt

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	tibo.sa194.seatt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	tibo.sa194.seatt

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	tibo.sa194.seatt

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	tibo.sa194.seatt

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	tibo.sa194.seatt

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	tibo.sa194.seatt

tibo.sa194.seatt
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4330
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/tibo.sa194.seatt/app_chest/uX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/tibo.sa194.seatt/app_chest/oat/x86/uX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4355

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/tibo.sa194.seatt/app_chest/uX.json

Filesize
5.2MB

MD5
08b2dcac6d95bf9169b65abf96d18f4c

SHA1
a52d56ff6eb43cb92f9a656a3c53d7fd146cc1a2

SHA256
5bacec5809058c0e576f8881095d244c14b84a736610fff89a7593dc1e9473be

SHA512
4b00793d96d5a59e01a9decddfdc853ab3e2419be0833899bc61baee5d76fbf06de8b92270477ec91c983308305c75f7b3f965548fe6b62edbcbbe68dbd0a149

Download Submit
/data/data/tibo.sa194.seatt/app_chest/uX.json

Filesize
5.2MB

MD5
427aa85947acca82b6b0a13a88f108c6

SHA1
19a76ef781a2dea48a037d6a0f82a49a4ded4ffd

SHA256
8d407190b2f19ec67258d92f3f36c20637b675d8d4b55c345325e02954c7e3f1

SHA512
a1a7f88484b70c234c1254770f6066dab1d0e3b37e489cc735c0033ad0a87799a01acc7d6373fa553aeb61ea1f1964e1bc630d5cae44983e13f9d7d6fbeebd38

Download Submit
/data/data/tibo.sa194.seatt/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/tibo.sa194.seatt/databases/a-journal

Filesize
512B

MD5
599f83ce07fc5e67e12628d3f68413ed

SHA1
827a758bd10c964196666e1169670baa4d07291b

SHA256
421f74bc6ac5f6ce3506d84fa1a022916b4c3786430f49a9e63cbd6b519de59a

SHA512
553cc7934e92e4918be526417b9dc2786fc509b469a7a83b1974626e9c30bc00edeab87eb5193efe765025d8d28f8613e5cf15725961df76125c8e2a75b13ad7

Download Submit
/data/data/tibo.sa194.seatt/databases/a-wal

Filesize
32KB

MD5
f09261cdf3226506dbf3366dadff48a1

SHA1
109afb80061b6f1cb0bb8d638e82510600dfb3da

SHA256
62c974d4f8d49b694b54dd55786b12f9f3a3c054f697cfdebc77a937cf5c2162

SHA512
9ba6573f23f86d99100e7d65392e17befa676a769e0b3a183bb600a7ac83d3debc03456d113995c8d90c54a1e12e438ee5029f0f4485422adf2829f792df7fff

Download Submit
/data/data/tibo.sa194.seatt/files/tibo.sa194.seatt

Filesize
256B

MD5
0142c50e5569401306039697b5b23995

SHA1
61bd3e48ae4f1bdb64e9e07ad0239500fec0e0da

SHA256
0bbbb1c4988a02105e8835cd45815500520b1a276cf2e4368864b263a6223453

SHA512
3fc81fb7ba6d2281d53845ba559bec3a22860522563185c18fe187ec0dde82718f84732d0748b183545cbb5b84b75152c788cb07741e81ba00c7d06a52f1f957

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
fb17c35118ea18eff9247b81fbbe90a2

SHA1
e86d0b6330afc28625cbee9abc4735de24d52eeb

SHA256
cd3cb442419281fae7c6f1a774b7ad81c1ac60a728b389aa1e6393340ab6afb1

SHA512
e8e6354ea280e94bb27b9bd3649f6759acb92c42c601f3d967d611c4f03ceb4aa4b3646a0248604a5c9a826e9a09d0f29e343767751ff4ce21983720724316fe

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
a1cecefd360e8e73c5949a9fdf60fbe2

SHA1
e41cf91b8a416005261d16aea9af32d7ee8e9d13

SHA256
1ba51121f0d4f0b20467417e7b11711d7732e258a77d2a0f1af00ea72da5d6db

SHA512
a408294bd5fd9f76ff9c9baf7836484466387b476ba4f68c32b5b312ced8992790f92b90b1f80c79375ba6393d3f58381d60bfed92334791bb9f3d5051615c3c

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
17d580861cff4e1bc0ad8217e6683e31

SHA1
801782babbae55bd7dde53cf76b4bdf2f4ec2b57

SHA256
a83bf5a09f3c95b816e3f3909a5654cdfab8c5bfee9af215169ea5b1b5221a22

SHA512
936c7c092e1d5cababd3d0f629d42a9e50c54fba5181aea854ddc192e935675fbf04fc2c5c599b4ff104026984d5fde3ac024ba5b5f5b76c8501de70977aa9f4

Download Submit
/data/data/tibo.sa194.seatt/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
818428a32e8519ed14d8fb28e773b329

SHA1
db899a12ca255a670d1b4c89ff96635746d5d7d0

SHA256
05501346943c2faa6b178c81a04a08b077336c3fc8cd735df814bbdb6c234ec6

SHA512
9d78375dee2f199d38795fad31e46a74231841641f6889675630be56bc96f845a5cb5fa3b3fd212ece09a9ba148a19f68cc089f8bbbb5e0d5b28ea8c5b05b4ee

Download Submit
/data/user/0/tibo.sa194.seatt/app_chest/uX.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes2.dex

Filesize
351KB

MD5
2c40764a05fede34d609a3153c21dc9b

SHA1
f50f32daca41b56a16edfcc1b3db8cc9508b13de

SHA256
f281069a24636924e9a474d7e374a73ae70f271a8404e4b99a140706aacfb8f5

SHA512
0a1924021add70495ae3f067b8219e4841c48d8b8dfc34c02b9556d29734df5e80373372c99440da0fc3a06eaea970e7d4e264b5a97218216dbbe6d07a03a769

Download Submit
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes3.dex

Filesize
257KB

MD5
bdef4f966e5e09a0f2168a19f32097ef

SHA1
16163a2ffe1ede91db16b0cde4e7bd277008c13c

SHA256
4ff3c79ab68c56d915d241c9764d34462116d72011080fa5cdcb914bd03046f9

SHA512
c220c442be8c662b6ceaabf06e010c842a6fe29c3cf805bb0af90e595a84afdffb2cf54c624a1a0cc38ced885add95877014cb4248ddf610ea653704051fc1d0

Download Submit
/data/user/0/tibo.sa194.seatt/app_chest/uX.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/tibo.sa194.seatt/cache/logs/log.txt

Filesize
83B

MD5
ee9efb35e5cc3a2b6a02c47a4872e8b8

SHA1
b40bcdca609107181068fca84b0950d0b6128c04

SHA256
c6a3244695cde1b2298334d80cdff6b8026989428c70cdcaaec1c92188f7191f

SHA512
4382c0c3870b160a8753243670a0c96373728aaca6ca0da781c1fc6b3f178ef4cb643a07a08640edf5452b6cfa054e0c6c052bc4f00d04b6b3aabb8fa5a4cb34

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads