trickmo | 85cf1361d652fb9f081bcbb2197f5855b53c70c815f72530b4a4cd6ce0876687

Analysis

max time kernel
96s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260129-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
submitted
09/02/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.3MB
Sample260209-phr8dsd12g
SHA256 85cf1361d652fb9f081bcbb2197f5855b53c70c815f72530b4a4cd6ce0876687
MD5 59f17a0aafb9ffcfaa8a5c1df802015f
SHA1 ef3aa3e2ce15e90dfd001cb3322b7e5cb5ee5854
SHA512 44e0183483ac59219084f6ecf1c65b88476b7f8ab5ad964ac226a8710ae45d5fd802c234018ee00f695634ca7d792b7c13aabdd85d5ac2bb0d773870c9e9eaaf
SSDEEP 196608:n3WeaiKf+OA6jN9AMOXJkB7VYl/i8S3lDOWFcv7u+:3We02O/AM8apS6d1DOm+n
TLSH
T17F761203FF5AD49AC4F78B33D9B1513241866E558B83D2471858B3BD297BEF08A4ABC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion evasion execution trickmo impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://havebeprotredo.at/243uwuyki

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/baal.maze.wagling/app_exist/COCBI.json	4864	baal.maze.wagling
/data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes2.dex	4864	baal.maze.wagling
/data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes3.dex	4864	baal.maze.wagling
/data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes4.dex	4864	baal.maze.wagling

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	baal.maze.wagling

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	baal.maze.wagling

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	baal.maze.wagling

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	baal.maze.wagling

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	baal.maze.wagling

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	baal.maze.wagling

baal.maze.wagling
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4864

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

COCBI.json

Path /data/data/baal.maze.wagling/app_exist/COCBI.json
Size 4.9MB
SHA256 f975ddef59012717e53a3b5a0897a671c50b2b4302043dec19876019806e6775
MD5 bc4ddf56d3d0da3b35a1becfec609be6
SHA1 7682f889ee904c965ca137aac7691ddef3162278
SHA512 fa9cc33e60a2fcc2d9ee6d2732e540407fb28af397079ed0e557b176eb1df1062089947361dd77f09d8f8d9868746a06436378d6f380b7dc62815eef9069d53e
SSDEEP 98304:5UGWa7d5dAIMlzEuT2AK8IdIgEWpBkcCrxzmh0nQnnCOtfhn0rlcLFO9xf:55xnAIqz5Kd1fkp14qQnjh0uFO9xf
TLSH
T18E3633187B53AC85D6AC7F8CF823F15383AF650E19AE8E6BD094FE51130F679215182A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COCBI.json

Path /data/data/baal.maze.wagling/app_exist/COCBI.json
Size 4.9MB
SHA256 da2c5726807ae6148061f1327648fe7bc74f1c1238d2fa7beaa82e864757d35d
MD5 5aba6a048291d01c2a38661c7a9d83f5
SHA1 2906b9debb48b55c453d44441f6e21765c2223d0
SHA512 3df70ce124662dcd93ccdebf4196ec411e9cdc529acc4c577047ba51eeb20972b1b8dd39d1a23d010402c16cfb42e95d5d9e199cedad9666298a180e326c3515
SSDEEP 98304:COhwEXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLn4:CIRiFA8p2mopLQBwTMzrbud4
TLSH
T1CC36339BFD382CE7F89DCAEE321B893D2DD503D6519CD4FFC1261081250116EB66AA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clicker.json

Path /data/data/baal.maze.wagling/cache/clicker.json
Size 21KB
SHA256 10e3784dd6515ea1777850f539f3db19c4be1e5cc89beb3546a3586e1db11bab
MD5 77e3de878b52dbe26edaafaab2226cb1
SHA1 d1df34efb194870e0b8f2f6c0283e5001d57a1a4
SHA512 dbaf12f90ddeed866b12d814eb5c462ee733a9c030a0a97f52856af552eb080d5561b417e406521a6091881c43afea8a758d2effd71dada546c54c9670b5b456
SSDEEP 384:Mfc8RL4YF0/gXPJDYF/ViD6UZsBGotheg8QGfc7Kmr5jeRHJMECRNZhB:Mfc8RL4YF0IfJDy9k6UZsB3theg8QoWV
TLSH
T1D1A2F11AB2952E37418E450C79BE4106BD389289B370485DB91EACD42FBF4F09D939FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /data/data/baal.maze.wagling/databases/a
Size 20KB
SHA256 49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c
MD5 57baf3e42a94e8dd82e267b2f0619330
SHA1 76512dd29fbaf3cfd2efeae0ac2ab5108b81af19
SHA512 227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690
SSDEEP 12:TLmaEyNTSFbyiyuE9dMARmBEyPbAVOwG:TLXREPjGSEG
TLSH
T1A492D8C793006A0BC25D5673ACB583E10DB0511FD6A9DB4768F518105E81A8464F1E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-journal

Path /data/data/baal.maze.wagling/databases/a-journal
Size 512B
SHA256 d5060148f71b2f60ce196c623f83297160a75274074c711b227d5928fbbb4d0c
MD5 5f6d0902f68b46417e4f0637b27a7c10
SHA1 8d64902a285b3fb31ddf9675b818beb5d1747c82
SHA512 a9bde2a5941bf92d0eff28426d3f80c5470f7f5b17c07b22c5c53505ea84387f914351e623a68c1157211a44df9646443891dbdde64bbb92fba9b7ae42a96304
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/baal.maze.wagling/databases/a-journal
Size 8KB
SHA256 532215ff86c7fea2cc32c205919c8611130ab437dd729fe75dce5147e5ebe34b
MD5 bfc22ce9f1f33c82988db926bb81a1ba
SHA1 4b2e2fa366ca3f12da319f0b1dec5763a418ff3b
SHA512 95b65aac940542ce9a258eb8ed3132aa55d29b853c2c7399c51e3125299db747fbbb634f8a3ff76e86b8b790f6ffe917ba7b8c050f219850541690c3027a2aa0
SSDEEP 6:7+/l9QFn1U4g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKu:7+t2Q4qLiuWdYRmBEyPbZ
TLSH
T1790222CC73800812C82926B790D883400D20A7288161CB1F1A910898AC075CCA8A0E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-journal

Path /data/data/baal.maze.wagling/databases/a-journal
Size 8KB
SHA256 e3f849fee9cf15c88dbc18eb62d7025ed3f3a1b4a7187926ca32823d24c2d96a
MD5 1ea6ca60ead3cda6a36b2ac834105b0e
SHA1 46e25fa6f6193db9582062b70009f7638b683ded
SHA512 ec88ad0490c72c8c3c99474b5c9c35e221e2ce079796c6a2f4c5ffd0eb962d0647d044f4d4df6b4b301d74322fe6bd57d3abeb1bc35058fd741da0dab0bc356e
SSDEEP 6:7+/l9Ga8HPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKX//+K:7+tAVqLJdeWRmBEyPbon
TLSH
T1B10222C863410813C12A57B7A0C983401EA0AF289223CB9B1BD208942E476CCA8D0D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baal.maze.wagling

Path /data/data/baal.maze.wagling/files/baal.maze.wagling
Size 256B
SHA256 a41bf36be0c1cd4274cc4d673ff43b0fbad756f20d9e3feefc4b9ef6d6c466a2
MD5 1479200c0fe603767be78c22e93ac460
SHA1 7ab6dc55037ab00286f53ffc22c79b279f9ca124
SHA512 1e1c8224b7aea47c81bc7acfb612520398830294a22638834947c0fc2a2969cb2cbfb95c6a1b47a2b99e9406cc628c74a1b869861515f339e28372d4986f0d69
TLSH
T10CD02B2117060C5DC94540660172298D81C59C5A140A5A43A5CA997A5E39D492B1FDD8
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 055697834f21e17e37a05d0c04bc3c8649885e79c75e0f152d6f41578ee10992
MD5 d104dd225cc654c12cc518fa060d7fd2
SHA1 52bd6655fe99f96331e9aa8f1661272af172ab36
SHA512 f0fe8562afe384f029c125af746c1d2e835bc115b29ed1038f31a3fef630cc33bf774c4f61ee8e210bc3972761353c4bbdf553936925db07294be8e4ff799494
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 d43ea5f903aefdfbfeffeb864b8cce328bf13eab0b49eb384c56cf6b3e959e75
MD5 0c4ea0554dd51c5132de3e64856d341d
SHA1 ae0c123daf4152ae7b10abc402bae592dc56adf9
SHA512 60d9056a451feb8f70bda30bb1c9e138a822e89da3f0bc3e28dc7f97a81df719269b674cf2bed05d66f8af840e8fafc8be50a59f79adff0bab6bd4af6329d2b9
SSDEEP 48:NBjstYoZubjS7jScZ/KJwFc9ZfQBjstYNDTZG:fgtYbOPLS+gtYe
TLSH
T1E9048E9E9BE193A5FDCA1CBDE0679EA644058953523CE0D00326132CF53D6ED382D2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 ac862d615ce887887847b44d5c52c906b5e2e4a1965dd9fc955ea21c8402f2d6
MD5 0eae19f6cecbd484f8dba262fb19e77f
SHA1 b74773f9f7038ba17964ac366595f0543713aab1
SHA512 0ff30f8ef2b39097636b876ca26eaa3619b32711a27167c8ef106ca63d849a39af1b19757a6575a8b11e3b8df06dad87f588ff8bd8fc1be7e377f0aeaf5f0da5
SSDEEP 6:Ke1+VO9FZde/kPlOERX4PBX4ogLugMBX4suuK+/f/rnOw2:KrVIzdeWRmBEyPbP/7nOw2
TLSH
T1DD72C25693401952E49B12FAA08A83491D21EA1DA772CB4BA7430A22FF56FCCD494D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/baal.maze.wagling/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 05b1b646f652854997bfdf7fab89280971a6311dbd3e7b5c2608999aa65acb01
MD5 685a11e966623dc8e0574b069dbfd82f
SHA1 7355efb696a96edd09d7d7d67f97cab0ace2b0ae
SHA512 09b9676137b05450dc026e1625ceef27a11b8b93c96d0cc2b963228b9c5a61358a2ada901d6aa170a3b20fef3601e7a404f1e04c605a9f40e8dd15fe45ba1527
SSDEEP 48:lFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9O:z6+hdjnHtDRMpf8UzS6+BD8q0ExPP
TLSH
T192B3004F0F192540C4DA54F4A1910FA1793EC12DE3B3E3E566924176FED2E60DD29CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COCBI.json

Path /data/user/0/baal.maze.wagling/app_exist/COCBI.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
TLSH
T104B6AE12FB566C33C4AEA3366DFE03517B31A2AA7B0347562414D9F87CC32D61AA87C5
MD5 SHA1 SHA512 SSDEEP TLSH

Download

COCBI.json!classes2.dex

Path /data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes2.dex
Size 308KB
SHA256 f8d680e934a09d34dfb513d82b8e41182f8974e4a3c5e219f8567cbf2703a356
MD5 1fe8a94b764c1fdc93868aea4c5aac01
SHA1 6b68c7fd7ede44bef671aafc4103aad16b5a3f1b
SHA512 bf78996e98ced0ee59b1e6f0857fcc9ba3e405f023515ed813efb59ca818169091111b5a19a433caffa442e72e0eda42ef7f0c2201f5a12e8312b0aaa9ac6f14
SSDEEP 6144:uMovmwaO0XYpGdYQoa9T6Jm59qS3mWzVc/ZfXlPPiaz6VuBOD:SzQzJegD
TLSH
T1536482093EC49D21CDBF6837728A436826A6D10203ADC743574B923F8DB75E46BDA64F
MD5 SHA1 SHA512 SSDEEP TLSH

Download

COCBI.json!classes3.dex

Path /data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes3.dex
Size 265KB
SHA256 fabcf2d9830d14db7a78b6c92f144f4fc49233081e6a22d47f472e85bfa4bb2a
MD5 947ea73f54bd22aa74485a3304469890
SHA1 973b953218d78031e11a2358a8a079e3ee00034f
SHA512 604d005f22bab4af4a9d97452fc6d73adaf3b0ef26d169f3ce65f976b37e1521dd99f20da338d71e662b8635ab036f86a469ad5f84c2f7f95507046604f708fa
SSDEEP 3072:5ot11ogt82WlS/96PB/WX1LaH3FUOAaMcrm0sDhXDXFXCYoXJK8Tgg2nyVHqDLVX:5othHWlFgOnVrmFXCYg2uHqDLzyG+w1x
TLSH
T152442B0BFAC46833D5ACC93D14B3A721BBB2E902E7435717052D85B67DC2392BE87199
MD5 SHA1 SHA512 SSDEEP TLSH

Download

COCBI.json!classes4.dex

Path /data/user/0/baal.maze.wagling/app_exist/COCBI.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
TLSH
T10C858C22F6098B31DADE15B50DE763F9633163E7A1839302AE995948B9C3347C79C378
MD5 SHA1 SHA512 SSDEEP TLSH

Download

log.txt

Path /storage/emulated/0/Android/data/baal.maze.wagling/cache/logs/log.txt
Size 83B
SHA256 7ea2e3ed34a356298455afc465dc6c310ac4d1b57a0c936fb5663e03a38f530b
MD5 cff83eadf3cf568b6418f383962042cc
SHA1 b094f374bd16a489c3f45cde10e19b45a85768e2
SHA512 fc00ffd4920815b42c7aa86b0ba48aabe57b9c4fc9f6a747f2d1744c31dc8e1faab1872f8ed6e8c81dc98c5ed1761cffc2718401370575826b1819cd1efd51da
TLSH
T111A0121F141D4383040085D06C7810326F334F632582400A0802270906640D9437142A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads