trickmo | 0e69f3d10ba88974c47a9ce83a095a29e9ac3de66b0441db60624fbe0772f6c3

Analysis

max time kernel
97s
max time network
152s
platform
android-10_x64
resource
android-x64-20260104-en
resource tags

arch:x64arch:x86image:android-x64-20260104-enlocale:en-usos:android-10-x64system
submitted
07/01/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e.apk
Size 8.8MB
Sample260107-m2ds1aymcp
SHA256 0e69f3d10ba88974c47a9ce83a095a29e9ac3de66b0441db60624fbe0772f6c3
MD5 679e8fce532c786e4ad4f9dce69b806f
SHA1 70c521e15fe1b79b3bb3d32eac595de70684d03d
SHA512 d7fd12c2a4c3f91203096a819069f31bf415c921fbd594014059b90bc8d5a4af913d48421ee6fd692a202996af1569f8016c1ad3182be62739c4bd0c9a00b66c
SSDEEP 196608:bZ2WVZmkpXy3Wi68P46s0GXm0CHvzNLwoCCwo38QTB:b9VQkdy3Wih1Cm0Cht7DsCB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution trickmo impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://dontcryallnight.network/bsq808t

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/begray.also.roister/app_idea/FuBapW.json	5039	begray.also.roister
/data/user/0/begray.also.roister/app_idea/FuBapW.json!classes2.dex	5039	begray.also.roister
/data/user/0/begray.also.roister/app_idea/FuBapW.json!classes3.dex	5039	begray.also.roister
/data/user/0/begray.also.roister/app_idea/FuBapW.json!classes4.dex	5039	begray.also.roister

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	begray.also.roister

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	begray.also.roister

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	begray.also.roister

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	begray.also.roister

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	begray.also.roister

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	begray.also.roister

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	begray.also.roister

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	begray.also.roister

begray.also.roister
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5039

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

FuBapW.json

Path /data/data/begray.also.roister/app_idea/FuBapW.json
Size 4.9MB
SHA256 198f5b9e44adf77f6be4f07cdc68f2fe01fe8be399249f14fab4d56d188ca536
MD5 77563f981cb25341a0dc11c3dbc416f1
SHA1 350887dfc6fb539fe3db8f44aab58f5383ec569c
SHA512 2749f93dd4071c9c6f43fb92ef5bbda0cf9af9bef0c0f050515082f26dd98e720c24ee81cc57541929b4cbf22b00dbea2447cf52a9f28ce0e37b41b470c67c10
SSDEEP 98304:w5+QcQjlNiT6rLgxn5aFIop/KqEWhcyKeaSgI9x8fOfQu9aalsY2kfQ4xcD:w5+EVLYMp/Kp4cyKNSgQKOfQ48D
MD5 SHA1 SHA512 SSDEEP

Submit Download

FuBapW.json

Path /data/data/begray.also.roister/app_idea/FuBapW.json
Size 4.9MB
SHA256 90903e1242e2ed168db8d4080624e81cc07a092f8a1f2d2042ad3ec4d0240d1d
MD5 0525c85f6c1f7ef1935c22b9c2185e7b
SHA1 58dc2c2a0ca7e3c3621205ba1cbb5ab5ddf53e29
SHA512 120810adc2b2dffdff0195e3ca119297c0ad55c6a1501e41102f1b760e5baa4e3d20de431d76a5ab3c8e52b33d563afb632cbc28ab714b3549720dfa7c33776e
SSDEEP 98304:qAOhwMXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLn2:zI5iFA8p2mopLQBwTMzrbud2
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/begray.also.roister/cache/clicker.json
Size 19KB
SHA256 8684e74bc368dc064ffe4d6e5d4a820f07b659298a9578b9a3e00b18a181de2b
MD5 575d7980edddbbcf6ca34c6048209772
SHA1 fbf5b309c48053a494cd0b9278ef4d92207a1772
SHA512 26694aba7f0f7b2750dcc9cb372463e6e4a4f7bbd08479c1b717a9a43c9151f76b7e187b72e5020bd79628a33b0ec4f04e2f780b317a1d1e4bd66ff01acf92b1
SSDEEP 384:5Ziw8/vbBrrlplvCVmC4RNaCSmtBcv59/ZqgXPJDYF/ViD0ttg4ZhZ:5Ew8/vbBrrlpl6Vn4RNTSmtBcv59/Z/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/begray.also.roister/databases/a
Size 20KB
SHA256 dc6bc98e7f294d8994b3120cb87c0ed1d998e559daab810a68323a8968c60c2c
MD5 93e7f88ba7fd4f0152e8e5dc56f1acc0
SHA1 f29883585567a32fe4d487e5df14173c39c09e65
SHA512 be40cb85f75181627e2e4f7fb01e371ad4ce5051416d7e931ae45479a1357526e89a017aa461de03076c0b650eb5c851c239e88556677e859bb9b7c28e48d745
SSDEEP 6:l9bNFlq4yl1Py4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLmPyNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/begray.also.roister/databases/a-journal
Size 512B
SHA256 a360fc78927ea44f2b084d89eeeb4d2701ecfb54a39f40fd8797b0f5446fdcee
MD5 2226df6a42e735e85154db5ce65517c0
SHA1 c6ac092456117386c374f877223afd8a4cd46e33
SHA512 53997efd9331812af44b673eb3ad4f11f86b2262f2a220c063a39df9492437dcb2614141de95b61043d7b9a0ec4e70cc0c8d926da847a275bcf213a29a95ca66
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/begray.also.roister/databases/a-journal
Size 8KB
SHA256 a4911e3076843fed8933562a57a4b8301675c297624ce85c4c0a106c704e0356
MD5 645a4b67b4e203e5aaaea96ee0f25dea
SHA1 1a7858f2da7fd311df103ffddce4baeb867916b9
SHA512 592bd181e6ab6fa0d824676d6bc093afcb669d26521e10358ff50cc77e1dd9d5a84e9dc0440919cea3d22783c84aaf2c74b42c115fbb5f7be5c3a44edb996227
SSDEEP 6:7+/l92t2Hn1S0Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKz:7+tMJ0WqLiuWdwRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/begray.also.roister/databases/a-journal
Size 8KB
SHA256 d60a34b1decef0249c84f6b35c95f25c362e82021de92847453e449f4b01aef3
MD5 c080251b039c27974f7938973be5357e
SHA1 daa4031a88b05e3c00fc4105492cfacaed448c5f
SHA512 ff0a898cf8c95c3eda87eb8b3c6b351fbc33907a3466ed002b46f5954a61db989edfc67ea407a7b9b8f586797ea89aab7dde8bb8c85d4d886aaa44d1630a1f9e
SSDEEP 6:7+/l9wEllgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKM5ns//4s:7+tyk4qLJdTRmBEyPbT5nsh
MD5 SHA1 SHA512 SSDEEP

Submit Download

begray.also.roister

Path /data/data/begray.also.roister/files/begray.also.roister
Size 256B
SHA256 f639ea253d96295b35ad272e1b9af922de7591db6155b1d45df568bda15b8d7b
MD5 8d46110f3013591345e93d666fb79ae3
SHA1 c7f7a2caa7c489c2280e5b998f4e6d773d9860c3
SHA512 723e04811372c319cbe1e4b8c9a28314b5994aa40965a49a69ad2dc5f54f184b5b68a5ba1cf89ac460db4aae8ec6993076b01d4d7d5d7c7daad7b2914c04f689
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b18bcc682613d81b7389348c365c7696fcfc144588ef89193b57a0224a34fb4f
MD5 3cc877784acc1b35c70bcdf31322960b
SHA1 caca513c385697f17a646950a5405c2d22f4a863
SHA512 841bd84bc9976771a3f5ae027c36719eaf34381137db1b7b4fc31aa0587fa268fada8c0a68139b504d2231bc91b5d7feaa7408adde7c31f8bcad2d383246553d
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 6d45bacda9588da259755737c7b8ce9e9f07db38497f286dc4374b5c404120aa
MD5 e642b0a568b29af9e432638f3f8ddc2f
SHA1 5347919f66324279dc67729c28cffd74376a277e
SHA512 31061417dede93a26ac106a9f4772b31450ae979e7fab007e857b8d997765f45f08e4856f6d784f8b2716d70a488d807d579e6e9ef6f0e86d408f76593608ee4
SSDEEP 48:5E2etYJ22aDj2z282Vb2X12Z2G22etY672Z12ES:54tYdaWtYzJS
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 b7fd4af7a7636d31049e84311eda5b22524d1921b49feccf14277fcd271119f5
MD5 5d075e5788f95c581d2240e375f9aba1
SHA1 5685f11f825e807fa6c5dfd8e5136a3ea9de33fe
SHA512 dd234ae3de092da6f8b6bc0692722e04d144c06ba68035b7bb8ac45218eb3a2311dfb0a5f0aaee9d16460b6921240a8311f88f5b9a6b799ec68a52dadf894d5d
SSDEEP 6:KgMhs2yy9FZdrlOERX4PBX4ogLugMBX4suuK+/1u/v7yl+TOw2:KgAA8zdTRmBEyPbP/wvOl4Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/begray.also.roister/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 dd760115c58bf71c1ef4cd0da90ebc25e6100044ecb88a79ab9c4d89ed7a9220
MD5 05de6eeb239cb19fc0b66a2b03e7bf28
SHA1 c855a419df7fca98eef0b2fcfa7896688fb65567
SHA512 3b2dbae72138c08a751b5876a7feb4a78e57a02600a37aef3c84ffed2b7e7fb06f8b4b58e251a70e80a42ee8fd63bf9d27fafa9b6f3b48ff12610a19be8afa4f
SSDEEP 96:d6+hdjnHtDRMpf8UzS6+BD8q0ExP2XeAl:hdjnHt9Mpf8UzS6+BD8q0E5AeAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

FuBapW.json

Path /data/user/0/begray.also.roister/app_idea/FuBapW.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

FuBapW.json!classes2.dex

Path /data/user/0/begray.also.roister/app_idea/FuBapW.json!classes2.dex
Size 308KB
SHA256 1556fc185859b0c5a3781fc4a7234a95370ca7a35316a1d37d18090bbb4ee1a9
MD5 eb809801abd14e2aaede645032700eff
SHA1 1404b30b31f8053c2f612a6118f37694d19c3e37
SHA512 510deb300f7f020bcabc6998387850583f9bcb6df174a9d93b465e5268e48e938b743390586b6f45180539079549b302c2677216994f4341ca98692ae6976f58
SSDEEP 6144:/32okMovmwaO0XYpGd2Z1a9T6Jm59qQ3mWzVc/ZfXlPPiaz6VX9F:/1EZZoJH3
MD5 SHA1 SHA512 SSDEEP

Download

FuBapW.json!classes3.dex

Path /data/user/0/begray.also.roister/app_idea/FuBapW.json!classes3.dex
Size 266KB
SHA256 785c78fed2a1cd4f912ad03b35bb8f17e8fb2e3a2a311dfb51b93bf6c6d3546b
MD5 c20750b45600a799c0a06d11fa8befd0
SHA1 f23b25b0feaf32823526c05eb9ebdb55011b04cd
SHA512 d912b6142c16d6fbc0c2ad969f9de497640d85354d3afa041aca23ebc0cf0ee7d260835fc006bd32c3cfdc7907a271882e4244bee3c1d698a341b0f328db7729
SSDEEP 3072:loVb6V/a28HGxIggdLxNm8VfRWX1La14OyqMcVmGsDh8QXkYtBiJY3j80JE9luFj:R/aNm6Fp94OFVVmGYzJz8ME9l5PwAjs
MD5 SHA1 SHA512 SSDEEP

Download

FuBapW.json!classes4.dex

Path /data/user/0/begray.also.roister/app_idea/FuBapW.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/begray.also.roister/cache/logs/log.txt
Size 83B
SHA256 dac3a9bda16b7ccdf4e32bb977d324498b84528a315de797a45d3c994c235c66
MD5 86a1425e2cafb524f3695e7a89500d37
SHA1 7e2d942b76f2e542a05cf8a31b5d96578dba8177
SHA512 41588d9db5a34b4f9fd68acacc8952eb7cd15f468f6f7cf34784bfc2fb4de201f098f00af84589f103dca41ec313ef7cac740957981d0b3196b0ec9beadad03a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads