trickmo | 74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919

Analysis

max time kernel
29s
max time network
17s
platform
android-13_x64
resource
android-33-x64-arm64-20260105-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260105-enlocale:en-usos:android-13-x64system
submitted
08/01/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919.apk
Size 7.5MB
Sample260108-ndvbhszrcj
SHA256 74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919
MD5 cb6e88044dede4d6e53cf6138457b0e6
SHA1 998f445a60404a047fec8ef36accff49bcb91fc6
SHA512 74a56790efe382aeca04f7b6bd7e6443198deaf8e7322e9e0abf9787f1b8b81009669982cc372c5622304ceb1021fe0f0122fdd67c8382b8806d167156921136
SSDEEP 196608:9T/cMeFzyuFAexqsGI07yM902slBbCV/djv5LHNIr0cuV5AyT:5/cVOQxqsGjXUlBenRLWWEyT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion evasion execution trickmo impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://buttergoods.info/rhn610pdg

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lido.ov829.nens/app_chair/NM.json	4073	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes2.dex	4073	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes3.dex	4073	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes4.dex	4073	lido.ov829.nens

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lido.ov829.nens

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	lido.ov829.nens

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lido.ov829.nens

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	lido.ov829.nens

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lido.ov829.nens

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lido.ov829.nens

lido.ov829.nens
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4073

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

NM.json

Path /data/data/lido.ov829.nens/app_chair/NM.json
Size 4.9MB
SHA256 4f5210c286fa99c38aad7cd0004144efceded781d6302edaddcd9a543849468c
MD5 db494c72890a4069df57714992d6d43b
SHA1 f0c9f09bace48b563866a2360e65a495639760c7
SHA512 dbaeb8d1eaf4fd932c1c4ae368890a56895a331d6769ffe7b22866819e507f066c4e8c690f3e8f92bf821d5d19fd1f251ecd8d761ca4a37c37fd1883bd69b287
SSDEEP 98304:tllp/C5se3XzS2pvWH+RS5KvQ87am4jXBSvBAAxm+JgrGng3taOxEvquKovhRgbM:tTtwSIrraMBAAxmWgestaOxESulJRgbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NM.json

Path /data/data/lido.ov829.nens/app_chair/NM.json
Size 4.9MB
SHA256 9c2b5391d8a69460f3826a875afa0e7c0ae49f3458bf1cf809501ddf7a920757
MD5 a76d7ad26cca3922da035734df5f66bc
SHA1 62dcff7d63bba8a2548aed3370051d32b55e8dec
SHA512 06bb8d3f02bfb215c0cc0b5b1837c5d7a19423adf94bd3a1c012af964837ee567000f2440b6b73e32f647a33db2c1931d24eb0dd285c4cbbca30b474bf0bde11
SSDEEP 98304:2XiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnf7OhwV:0iFA8p2mopLQBwTMzrbudjIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/lido.ov829.nens/cache/clicker.json
Size 21KB
SHA256 2a751cbdc58a3c925d5aa656b8d8aaae49798bb2b86eaaa8e37571de37bee770
MD5 0e210ed61eca5310bc422e63d66b6a60
SHA1 8532fdf4b01a69a009d0a6005d8ed762dc6c80cc
SHA512 213f3e6900b3d167f7284091a7ac2063a67cdcbcb289e12512dffc4dcac8ff9a1b4dc98e68f3c04cc470683ec70af1cdf8829cc55a095bba96cd1c91de87631d
SSDEEP 384:5Ziw8/vbnrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:5Ew8/vbnrlpl6Vn4RNTSmtBcv5+40fJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/lido.ov829.nens/databases/a
Size 20KB
SHA256 5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923
MD5 91af32c14839a2828ca58297e0861362
SHA1 bd758cc0bb47b570da2061d4633aa998a87ed971
SHA512 9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7
SSDEEP 6:l9bNFlq4yl18y4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLm8yNTSFbyiyuE9dMARmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/lido.ov829.nens/databases/a-journal
Size 512B
SHA256 66409f31d714c23809871e52136d492e1f9bf88bdf0b1d57f27e136f58c21205
MD5 d4b5f0b6386212630f35c57d6582696e
SHA1 a1b50217e4cd263b5b572f2d0623aa2fbadef027
SHA512 6b1911a0b66acf216b74beed14a2c772b7a8a525137cdeb29a4258513da4983247d185be3ee8e35e226bf21aeea7f291ade28c27c8ef31503888da6612341344
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/lido.ov829.nens/databases/a-journal
Size 8KB
SHA256 d57f384d329c894b3033378ea7951d14ad6154e5f5ae18a922d0bee36a67b71e
MD5 231b603e332cefb3199f55dbf37f4cbf
SHA1 df4baa1082992b57c66592d86d1654968949dad6
SHA512 562d0187c247ec096ca40d5035900bc4e65ec8033801a52cca592d1533ed0f9f1ee8ab37dfea3d12334d11edb823e8f292668eebbd9bbd8c845f4de1103ab790
SSDEEP 6:7+/l9frlgn12sll/vg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKG:7+t9qvqLiuWd7RmBEyPbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/lido.ov829.nens/databases/a-journal
Size 8KB
SHA256 416d070032f70850c9f0629af26a094e6d878dc254aa89e6296846ec6931c149
MD5 84b12cbbf8e1997cce8b90c0578818d0
SHA1 2442461f0b747c09b3ee3bab0e686405e86d4110
SHA512 61c4b6501305449185e11386871cf047ce8d02c921ca49d4287243f0094c6df78b00777f538f1ecbab12861c291b22bbfde5f596a554e00bc7cbd1f09576a218
SSDEEP 6:7+/l9lPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK0OC/Ob:7+t7qLJdKBRmBEyPbZfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lido.ov829.nens

Path /data/data/lido.ov829.nens/files/lido.ov829.nens
Size 256B
SHA256 8ae3b09df62face8b62084e7f25c8b140c2b36c4c533a4018bc1103e1042811b
MD5 45e31c05739752c1483412dbe3b371ad
SHA1 b21f766de32a8fe5b9d0a361185a8246744412d8
SHA512 1d590347ed712c720b6132566f9985f04389ef9ba37416e69e6fd2597643cc12f76319df6c5f6245ec00e92dd2732d1961718cfb4daa17bdcd70cb48b1846e1a
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 24fe71f3b4effc6f82cfae5dc5a68c23effdc27b27538ab47c0e57b935b96a2c
MD5 20c89ad887438d2edb12704254bbe085
SHA1 cc878234b2c07ea0e49462bb803571e92f24ea35
SHA512 3e6213657d05c811947bb40b234de91b52ae1a2e193c4b5d1fd17cd46ff77e99eecca96084d54a07fcef487c39b6b6ef6c5dfd2cf50ce792589d29f5a7d66c4e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 b3b111cdae68ff195ed5892b4b799b89ae975df79c437352bc59ee3636982a77
MD5 bc666ea764bed6b613339d4c089d9f3f
SHA1 0b2ce9371f7d871ff9728abd4fa21d43b446f8a7
SHA512 d01dd594c4af9e46f8f68bd34dba02e6b6074b3446c09eca523d82906dad5178b611ec8c0a10c036038a96c1b1e57cf1fd50fc8ea5748cd41222fe93fdbeb521
SSDEEP 48:TOx9tYixq0qx7xfx1hix/xjxJx9tYLPYx8xw:6ntYioDxFQpVrntYseK
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 20889d73c5ced08c6f39762f3e923dae2229000485f5914b662a51ff64888777
MD5 7cc681fb26f60f251d5c3f3ffa1d842a
SHA1 d3df1083e2fcb71f0352de20f71cc2687387a05d
SHA512 d013b16e7fa77c5afa509805c4786d384acb1ed382966dff7a9a7274f13868f31b2271ab62ca9f5ac1fbb0c543f47980c1a5a0fcf6ef99f857427ba18d987ac2
SSDEEP 12:K4cLSzdKBRmBEyPbP/xeEtfzCAtFFQOw2:K4dzhGSP/xxfOyQ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 ab8b1dd2b68703aa15cb246258cc5b42b8b7a76ec0975b8f2a06a1fed7ca6f80
MD5 0e91b6f012598bdb56e82216b249ff79
SHA1 6b13852bc6b4006f5938bb2c8a0f169b1a7280ec
SHA512 02f854c5c1d3a7a814eec1a2ff036463d7775a3a805b406d67e44a9e1a69cf0cba0ff01e459c6d52088f7f2a763e5e3e0f91fd296297f4622da5cd38a634de09
SSDEEP 96:F6+hdjnHtDRMpf8UzS6+BD8q0ExPmsInBD:JdjnHt9Mpf8UzS6+BD8q0E5msIBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

NM.json

Path /data/user/0/lido.ov829.nens/app_chair/NM.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes2.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes2.dex
Size 308KB
SHA256 7d5c71a46a8a6d06106b159df32dd2a39b2c6d53e792cd119c98026501034bac
MD5 6734ac7ee62720b173465e9f47194921
SHA1 aec143ea2c8363778dcb912d1e3ed9b3e1cc1644
SHA512 01894539626374e7280fd9c936011c1c5ab8db934c44c884aa2cadc73b1462b0683eb1d30fb39838388f39b0ca6664a63e8c85654fbc5fb6c3a3a076a845d172
SSDEEP 6144:H3AovmwaOQX9MEQN8a9T6Jm59qJK3mWzVc/ZfXlPPiaz8V6fbe:HHfJ4je
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes3.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes3.dex
Size 265KB
SHA256 5a67ab6c8821cefd5cd1c5d844c0b51383c14a92a8e253aff579e8df5a06de35
MD5 1888959ee2246ca5c710f36405dee428
SHA1 d9f1bab67a9171582fed3861e8333e45447bcd20
SHA512 9dfdfeb82869024b59fc802c7b2d03e17e3f5f4f4e4568c51654529c2f39e876e1fdb9b295c8984ce2aba556a8d8edf343b4d7aa96654b6a899271c86645339a
SSDEEP 6144:6D2er15Aps8lsjhmTgl9mrPVtZJzPfhgihmX:67r14HswXhmX
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes4.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/lido.ov829.nens/cache/logs/log.txt
Size 83B
SHA256 2497cb762183e36af14be423589454e9bb3e78dcc328e1c65caa5d85fdf9c7f2
MD5 87d6a017bfb5f47295121f951943c076
SHA1 9f484b6cd8fb888bbabff4ac623dc70c87c4d3ff
SHA512 7d85d16493eb24d15cb4814e10249f9151addc81554856abf7bdb2bf5da295cd1be1517d51177be83538f8ff637dd131dd6a1192f1fb0127c663ff0fa0d21c7b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads