Extracted

• • Target
    ee44a8657b3b17334987f97cec5637289e82fa5f8271234d05ff8b1251f4c42c
  • Size 13.1MB
  • SHA256 ee44a8657b3b17334987f97cec5637289e82fa5f8271234d05ff8b1251f4c42c
  • MD5 afacccc150a40f143d07625796b4b6bb
  • SHA1 fff7305e29bba3c56832f7ca3444e733522a59a1
  • SHA512 23d671fb3f65197ca7bbf73e82704e0dd9bb23453f36cce19ddb443846ff019c5e40cf09445e356667f04df2114fb5bcd63295176183c7a03111cb82f3a7310d
  • SSDEEP 196608:jG4ll4zCbJIawbadHzGA5g+MmB64qRgBGCVOTZOSAUAuKuB+31Et5CxWokbsWpGq:j9D4W+QBzvhB9qRIGDOruxl4Hq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  collectioncredential_accessevasionimpactdiscoverypersistence

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2
• • Target
    deper.apk
  • Size 8.0MB
  • SHA256 68f06e18d1b43ff5c832a4bc556fd89d1f9afb457dc5f1dbbbc0bccc3176b288
  • MD5 82576e2ed81999911ef96a66dee4a048
  • SHA1 0f2e41cab87c42bef0500565476552b49d4b47b3
  • SHA512 1360a4f0847f7c32fa3fc1da1ffae3a0db41253a9f1997015578663fe95828bb035bd4a8550867a15127e088c0a65bac18daba46900981a880181294f1d6b13d
  • SSDEEP 196608:9n7gsZZZM2eX8E86A+iEKDgDD0Pngruak:CsZLMiErKhDj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionevasionexecutiontrickmoimpactinfostealerpersistencetrojandiscovery

  • TrickMo

    TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.

    trojaninfostealerbankertrickmo

  • Trickmo family

    trickmo

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery
  behavioral3behavioral4