trickmo | 74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919

Analysis

max time kernel
29s
max time network
27s
platform
android-9_x86
resource
android-x86-arm-20260104-en
resource tags

arch:armarch:x86image:android-x86-arm-20260104-enlocale:en-usos:android-9-x86system
submitted
08/01/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919.apk
Size 7.5MB
Sample260108-ndvbhszrcj
SHA256 74a7ef8243e6b7d248de31f56060d47c2e81dda20f24e566d6d8fb0b43594919
MD5 cb6e88044dede4d6e53cf6138457b0e6
SHA1 998f445a60404a047fec8ef36accff49bcb91fc6
SHA512 74a56790efe382aeca04f7b6bd7e6443198deaf8e7322e9e0abf9787f1b8b81009669982cc372c5622304ceb1021fe0f0122fdd67c8382b8806d167156921136
SSDEEP 196608:9T/cMeFzyuFAexqsGI07yM902slBbCV/djv5LHNIr0cuV5AyT:5/cVOQxqsGjXUlBenRLWWEyT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution trickmo impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://buttergoods.info/rhn610pdg

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lido.ov829.nens/app_chair/NM.json	4221	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lido.ov829.nens/app_chair/NM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lido.ov829.nens/app_chair/oat/x86/NM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes2.dex	4221	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lido.ov829.nens/app_chair/NM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lido.ov829.nens/app_chair/oat/x86/NM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes3.dex	4221	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lido.ov829.nens/app_chair/NM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lido.ov829.nens/app_chair/oat/x86/NM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes4.dex	4221	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lido.ov829.nens/app_chair/NM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lido.ov829.nens/app_chair/oat/x86/NM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lido.ov829.nens/app_chair/NM.json	4195	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes2.dex	4195	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes3.dex	4195	lido.ov829.nens
/data/user/0/lido.ov829.nens/app_chair/NM.json!classes4.dex	4195	lido.ov829.nens

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lido.ov829.nens

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	lido.ov829.nens

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lido.ov829.nens

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lido.ov829.nens

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	lido.ov829.nens

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lido.ov829.nens

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lido.ov829.nens

lido.ov829.nens
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4195
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/lido.ov829.nens/app_chair/NM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/lido.ov829.nens/app_chair/oat/x86/NM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4221

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

NM.json

Path /data/data/lido.ov829.nens/app_chair/NM.json
Size 4.9MB
SHA256 4f5210c286fa99c38aad7cd0004144efceded781d6302edaddcd9a543849468c
MD5 db494c72890a4069df57714992d6d43b
SHA1 f0c9f09bace48b563866a2360e65a495639760c7
SHA512 dbaeb8d1eaf4fd932c1c4ae368890a56895a331d6769ffe7b22866819e507f066c4e8c690f3e8f92bf821d5d19fd1f251ecd8d761ca4a37c37fd1883bd69b287
SSDEEP 98304:tllp/C5se3XzS2pvWH+RS5KvQ87am4jXBSvBAAxm+JgrGng3taOxEvquKovhRgbM:tTtwSIrraMBAAxmWgestaOxESulJRgbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NM.json

Path /data/data/lido.ov829.nens/app_chair/NM.json
Size 4.9MB
SHA256 9c2b5391d8a69460f3826a875afa0e7c0ae49f3458bf1cf809501ddf7a920757
MD5 a76d7ad26cca3922da035734df5f66bc
SHA1 62dcff7d63bba8a2548aed3370051d32b55e8dec
SHA512 06bb8d3f02bfb215c0cc0b5b1837c5d7a19423adf94bd3a1c012af964837ee567000f2440b6b73e32f647a33db2c1931d24eb0dd285c4cbbca30b474bf0bde11
SSDEEP 98304:2XiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLnf7OhwV:0iFA8p2mopLQBwTMzrbudjIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

clicker.json

Path /data/data/lido.ov829.nens/cache/clicker.json
Size 21KB
SHA256 2a751cbdc58a3c925d5aa656b8d8aaae49798bb2b86eaaa8e37571de37bee770
MD5 0e210ed61eca5310bc422e63d66b6a60
SHA1 8532fdf4b01a69a009d0a6005d8ed762dc6c80cc
SHA512 213f3e6900b3d167f7284091a7ac2063a67cdcbcb289e12512dffc4dcac8ff9a1b4dc98e68f3c04cc470683ec70af1cdf8829cc55a095bba96cd1c91de87631d
SSDEEP 384:5Ziw8/vbnrlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:5Ew8/vbnrlpl6Vn4RNTSmtBcv5+40fJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-journal

Path /data/data/lido.ov829.nens/databases/a-journal
Size 512B
SHA256 85acf3e60aa45ed1e26251b4ebf70e9358f758ceb0e5e8783fcd04eb32901d97
MD5 61aaf1f8d4bc082b6efb3514a9cd4d30
SHA1 0b61bcf0445f97b209963950fee7432fc25e5893
SHA512 30cbc8b0b8ef7f568c1a446ee2cea6dde0fc32255b28f341d885ad569534ffe4de86a508d7cb8d78eec529f152dad5df3ace31fe41453657010f930e2bee0ee5
MD5 SHA1 SHA512

Submit Download

a-wal

Path /data/data/lido.ov829.nens/databases/a-wal
Size 32KB
SHA256 388607ab351ca51d4a2f29181e9dd05d0045a36df985428dc5eca72feaa03d96
MD5 6c6f25bccfe6ae87acc62752245b377c
SHA1 8201381e1062d2e5c9e35ef13b169cafd05a7bbe
SHA512 f33c62d7b2245fc1e87e480bdaad6fe522a524621d354c65a21eee21b59c0ae19f3b15218479bab4dec09f64ded6e45dd1e3f3801036015715eaefb63fb85aa8
SSDEEP 12:KUZ8nkzdTRmBEyPbP/Kn0K9iOwCli8kDqyNTSFbyiyuE9dMARmBEyPbP/Klv+zl:KUmnkzyGSP/Kn0KqakTEPjGSP/Kwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

lido.ov829.nens

Path /data/data/lido.ov829.nens/files/lido.ov829.nens
Size 256B
SHA256 fb5b4d81ed06ea935b3fe2b4f5166ce18a021303e7da0666860dd62becceb3d1
MD5 867c511e40d42c0de7cfebee13d78ca2
SHA1 cf2a4e655b03b9691c64cee2a771cac9810320c6
SHA512 6ea8b6a6d8d37d3c13ae46ad96210d8764a6ed511d08cbb215bd9c3d2b4201e8b3975fb429e2cdb7248a2bc31ae0646f1e466b91139e20c92da4c64b313cb8fc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 59e834255db9721539f71f51bef1668c7737eda4b332d7fa29044be573455d1b
MD5 6a9215909d9f3ddbf96fd7e82bbb7c82
SHA1 407b5733b4043023b432d3a3f3dc63491cedb928
SHA512 76c1e5fde2c14687279abdf487a305e121484383460aa9872df2f1e99df80bd4f52d9c05f60a9f00f73a7c4a0cebc6f8e0989a610d1ba085713ead67f0f3e869
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 0c07c9545bbce2faeb6b5976cb98cc26e9c3a8d6930de6fecaefa093a8a0fefe
MD5 c960969c3304837dd0798fc133285e6b
SHA1 f7323420ac96c3d3884906bc6dcd3324793bbc8c
SHA512 f91d205660226a15f0afa7c1102b91c1bd2341e314c619cd58476c220f0577b1b71e506736ed7b00eccbb741ed752bc6847af2263ef174efe58ba7afe003ef13
SSDEEP 96:X6+hdjnHtDRMpf8UzS6+BD8q0ExPNxSi+GZ2:vdjnHt9Mpf8UzS6+BD8q0E5312
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 41132d20215ecc9ecc8b48249a6fc751317e173eb18bd3cee871d394e7a8af42
MD5 82c13d1124a68e7398859e2b899dd45b
SHA1 53f5f0f8a57d071ab76d01c237a396319ef1980d
SHA512 e22ed675cf3de6bc4f42273a3cf4abe389b064d1e816e57a657c0d9fe92739bb8e66a66316a330e6ec2ac1438897b96ab6427ac87d90b0ddbd1851e4fdb7457d
SSDEEP 24:9dKtYNdnz9A7ldnucdnwdnAJtdncqdnldnCdKtYnzGdnUsUdnd:itYu7OkvtYzt
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lido.ov829.nens/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 6884e5a9f65e2f1e64e158fc4ed683e2bccf5c056c03001a043fc7d4ef59646b
MD5 5c29607fa78f098ccc7cb12365e90587
SHA1 3ba42d36d064cd37f5f1822cb8a458b961bbd8e5
SHA512 0b7c672ba9287af65c255f5563e271545a5f520b991c70041f867e0096b0a6d1fc5a73cfc35fd30faecb193444a3adffbf3c5c3e1372a097a88cd6e6b89fff00
SSDEEP 6:K6JViKlv9FZdrlOERX4PBX4ogLugMBX4suuK+/YrV/1eOw2:KEVXlzdTRmBEyPbP/SdMOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

NM.json

Path /data/user/0/lido.ov829.nens/app_chair/NM.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes2.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes2.dex
Size 308KB
SHA256 7d5c71a46a8a6d06106b159df32dd2a39b2c6d53e792cd119c98026501034bac
MD5 6734ac7ee62720b173465e9f47194921
SHA1 aec143ea2c8363778dcb912d1e3ed9b3e1cc1644
SHA512 01894539626374e7280fd9c936011c1c5ab8db934c44c884aa2cadc73b1462b0683eb1d30fb39838388f39b0ca6664a63e8c85654fbc5fb6c3a3a076a845d172
SSDEEP 6144:H3AovmwaOQX9MEQN8a9T6Jm59qJK3mWzVc/ZfXlPPiaz8V6fbe:HHfJ4je
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes3.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes3.dex
Size 265KB
SHA256 5a67ab6c8821cefd5cd1c5d844c0b51383c14a92a8e253aff579e8df5a06de35
MD5 1888959ee2246ca5c710f36405dee428
SHA1 d9f1bab67a9171582fed3861e8333e45447bcd20
SHA512 9dfdfeb82869024b59fc802c7b2d03e17e3f5f4f4e4568c51654529c2f39e876e1fdb9b295c8984ce2aba556a8d8edf343b4d7aa96654b6a899271c86645339a
SSDEEP 6144:6D2er15Aps8lsjhmTgl9mrPVtZJzPfhgihmX:67r14HswXhmX
MD5 SHA1 SHA512 SSDEEP

Download

NM.json!classes4.dex

Path /data/user/0/lido.ov829.nens/app_chair/NM.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
MD5 SHA1 SHA512 SSDEEP

Download

log.txt

Path /storage/emulated/0/Android/data/lido.ov829.nens/cache/logs/log.txt
Size 83B
SHA256 ecf967f48f54f40f0fcf1d79bc550f36e572c393021fd406983e2ffb64dd1bd0
MD5 def94979e865f6c7ab94cdc3255f5792
SHA1 83686e26fbfa87df00614fb20bc884b9a6db57db
SHA512 eab879a4c8ef0409dc8f758158a4d59c58e1cd9e344b3cbf024a872c879f58b693ae19b81a12a6ba9ba9f5e24be6feff4975ee2e05af8f3db2377457acadcaa7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads