trickmo | de2f904d65eba7777a07c589376da441bbfa08ea3b42f66f558f17ef25e52198

Analysis

max time kernel
126s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de2f904d65eba7777a07c589376da441bbfa08ea3b42f66f558f17ef25e52198.apk
Size

8.7MB
MD5

9b231942e29f923ef4fb97282f0f2f45
SHA1

e5a47a7adf82646459dcb07022ff7f8416e90afc
SHA256

de2f904d65eba7777a07c589376da441bbfa08ea3b42f66f558f17ef25e52198
SHA512

5e9f5319b2efdf65ce5b76858445c910cd6b787694fb6cb5e43f5ea4103f0bb57d9f8f6246fcd99e885e9355773fd54e642253a410b40049ce9b6d0b7223fb15
SSDEEP

196608:tZgnrCYktUe6gLshD/xDdhhVKGcME6JI6ynpqOLjv5Ldh:Lgn2d6FD/RXhVL3E4UPHRLD

Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://monster-truck-mx.info/c

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json	4400	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/orkei.ti981.pay/app_ordinary/oat/x86/UsU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes2.dex	4400	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/orkei.ti981.pay/app_ordinary/oat/x86/UsU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes3.dex	4400	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/orkei.ti981.pay/app_ordinary/oat/x86/UsU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes4.dex	4400	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/orkei.ti981.pay/app_ordinary/oat/x86/UsU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json	4357	orkei.ti981.pay
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes2.dex	4357	orkei.ti981.pay
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes3.dex	4357	orkei.ti981.pay
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes4.dex	4357	orkei.ti981.pay

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	orkei.ti981.pay

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	orkei.ti981.pay

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	orkei.ti981.pay

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	orkei.ti981.pay

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	orkei.ti981.pay

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	orkei.ti981.pay

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	orkei.ti981.pay

orkei.ti981.pay
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4357
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/orkei.ti981.pay/app_ordinary/oat/x86/UsU.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4400

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/orkei.ti981.pay/app_ordinary/UsU.json

Filesize
5.2MB

MD5
b4122e39c8294ee9d31d50d449d63f3b

SHA1
45b43b7a92109ac0dc68f408c721c324ca083038

SHA256
f2ac7eca10fa7bbebc5baeae00dd962326265f56b7a45f346d0731a8b173d8f9

SHA512
3d825fbcb80086711030b8f2cc21c9b0b78e9e5c45bb10c9631220e77c1cc41d6c2eff1beac87c12053b92b8175edbc81c1b6c56d96c85293e313bf293f09e22

Download Submit
/data/data/orkei.ti981.pay/app_ordinary/UsU.json

Filesize
5.2MB

MD5
d930f180f1870368fbf3ba540d294141

SHA1
bc00472d426503389dc544f35c5a319f57d3f638

SHA256
e36d07269561bdc7175c07e690d2785c3940bc1627f8ba0e811e32f794575343

SHA512
8d9758c1f86cc89d43e0585ed053edd21a2c523d5801f75d7f99cbd503963e418cb9e1eb6cb05de91a7ccd5252405ac17c793406247f575a44d076d1dbed0722

Download Submit
/data/data/orkei.ti981.pay/cache/clicker.json

Filesize
17KB

MD5
d780f836fe54e51872bf31220a4dcb77

SHA1
5136aa7fe35fb70c9bf0ab00bbe7f79cf65705ae

SHA256
32abf05fd8eb1edb10fd93e2c0bd9b308d109e5686c06b39f4d173847a0efe17

SHA512
62842bd62ea2f1a71880415d84501bc2cde8eb857d4baec4e357f3c4c4a74d2d0418bfcc6431789cce207d5290ceb4b1fee31f206ac527a8727176523c0bc635

Download Submit
/data/data/orkei.ti981.pay/databases/a-journal

Filesize
512B

MD5
de59c2ac9ffd30767ac66880716a4a3a

SHA1
c8d053113207ed3df280c88987b03e0e828c3b0c

SHA256
c82e0fe4da6f00e9bcbdba32f5a150998b4775b41ca80681ab4a1c5c7ba9e24b

SHA512
e7011e7f83cad909cd006876323689b5fd92841644608fa64277c2f3d9eea527b8642282831630786b16be2825311987d4efe728799db18d46a3d1cc57f82d40

Download Submit
/data/data/orkei.ti981.pay/databases/a-wal

Filesize
32KB

MD5
83c78c23eb18fb615df07b65686e3e8b

SHA1
f6e1ad0419f477b55de24d48ce203195393dd7fa

SHA256
13558ba62db36629bbd1d28a27a13d442ad1de4db86c0b5e3d6584a726fac42c

SHA512
201825c309a5d4d84d81289dfa4ec9bec649171f9d460229cbeabedad56fa48d83c91f899e67e4a986f65cd40e918a65074529ebe3632552faf6242119ca91d3

Download Submit
/data/data/orkei.ti981.pay/files/orkei.ti981.pay

Filesize
256B

MD5
2cbf8501811f2f4d81ad4c4200180105

SHA1
875ea519177271c098db6e150dddd61f33a48e56

SHA256
c9ab7adaf0ca9952d939e3967d8b2fe3e3d11f37c726f529a045a7ae3acf6db6

SHA512
0138b89f93d92ea097d4fc37cf75335dafaa95dab6ebfc251ba1a9f03a34c3e055d95a6c72109c16435577d3a52814274c85ebeca30c01f647a4cc9a1d9605cf

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
10534c5c395141d8015192ccb22a4205

SHA1
ed7ed4dbddb1f89f6f52dedeb1e4f004091fc971

SHA256
bf918c5a971a22cf162f78a2e7eb2d2dc321b56f2227be5049f0fffffd27c0f7

SHA512
cdc9768f138ce134b7e244f2851ea9874b3150f7740b9cb20aea371423925cbc1349c93a6e118e6a6cd0eecc5bc46af8f7a5bcde66b255154273ff94f29deb58

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
dada99b4c2dcb1b06438ad5513198792

SHA1
47c4a45c93961a71973f0d31018fb9d14be4989b

SHA256
301f709083e3cc2cab3b4356f1a4567a9ba279128b5f3b0e0ddf8a559a8aa43f

SHA512
53d3295ea6ef5b1166a6e64f7ed511ac3eaab0f76bbb63961e93371e869561752b52490a7dc32b3e3630425a8b7101a982171587c247e3886685ed89d82975cf

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6bb725a6ca466a74ff56e3922f6b91ae

SHA1
45eb9e564397c3b3848f77ef89bc916c787d9545

SHA256
bd1b60e15c113ab077e62ff8cbb235965b5d0cdcf658ea96378c01cdf09f6f2b

SHA512
0de47bccb0166d593581d2588880616cb2152edb86bf5060d5abf4b5b218043ace2cf2803f6b6fff9dc72361cd6f6a97f72fb808bd59994da6ce47afe132bf86

Download Submit
/data/data/orkei.ti981.pay/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
30ffad779f444c49ac38b5b1a5661ac3

SHA1
96e2ba18ad47812019abb07a346c75467bc50c4e

SHA256
1e7bc3e202e4a0e39d9c77105dc4f283857f999b5d098b850c5fbe7366731f67

SHA512
a5578de5d42463d4ae8ff99e1b0d0c81cab7f661edf576dd9470f3e9ff80e00a1b6e347d460337bd96e4a3cc5738030cc455e31a456f9c98f0c6a0f153e7fe28

Download Submit
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json

Filesize
11.1MB

MD5
28041432b0c51e3e887643272629c83e

SHA1
fbea5dfc62f03e1ff784b410ec0d547de0e8156b

SHA256
85c845feaa13eb5b0d02b64a996bf1a84b3aa77b6cf616f3db8ae5b4c70e9902

SHA512
7e69a4dffce031e990827d655b83ce66bfca72ecdc5bba4a264f877e0a3788953c41e2f6766e8327127d1b68b63775569648340fda09b4ce13684f0aaca6438f

Download Submit
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes2.dex

Filesize
351KB

MD5
09ca76eaccf11fb9b5769ba60ab9c278

SHA1
7f0e71a691459dabfac24cf1efcf0e6d04ee2d7b

SHA256
e9b22b9dffc776ab692b527cd7a4b0d2cbbdc74ac73e8f40adbdbab6b8e12115

SHA512
dd4fef6aecd6330ae1d9926e0549e383758361a05338d0520a29ad69ef4b8c69a1e6142d99adb70d4f8d8341aefb10ee989e83d00d894ddfcff071958450c13b

Download Submit
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes3.dex

Filesize
265KB

MD5
0807e30b8ae3f6dc61c13bd56d2c9a03

SHA1
44f859d7c1d180d658e829d04126a39c48269ee6

SHA256
2df538d987437436baf41fadef8a4e17a1ef19f96a002372d001ff7d4ea227ce

SHA512
0dc29f85ce95d2eb3e8e9718f01f5b624458c42cca80ea55edc5d9e09410e01491e2f98603e86468fb3a2706bd6b9b100766d78cfc0f968cf4504860db016fd2

Download Submit
/data/user/0/orkei.ti981.pay/app_ordinary/UsU.json!classes4.dex

Filesize
1.9MB

MD5
2d73c5997273e3910c1ac1d8db7ba145

SHA1
25737e75ed15863e69d02a14efa781370dfec798

SHA256
411c3194c11f6254e4bb6cdbf247518a4696ce9bffc6d373ba7e949889db9965

SHA512
7adca729d74394232c26ee76272a85342fd88c9101d417ba3a0b1018f29cdbe4a852a3458548e4e333db55520cf8b0a7700f6bcb3cfee77a12ec3d272c4dc13a

Download Submit
/storage/emulated/0/Android/data/orkei.ti981.pay/cache/logs/log.txt

Filesize
83B

MD5
75da31d5788b4227b5fccb06cd2e31c5

SHA1
e9acf3ef3fd14b5d6ee1d920e769e7ed4c18c94c

SHA256
610a0c15405ebc3af684468b313b866c014b769255991e8ac8251f3a2745e4a2

SHA512
dd1ba2a67c0798d750308963c17a3171a8b1236e1264be7a0c7e6e59b5cca361325cb185dfc6a1f72d032a3640816866fb41773f74603c21186c3d2da5bb9887

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads