trickmo

General

Target
53e3b161de04d71adfe6b2757cac9c349cd4ff4b49fc9de5371d4dc3f6b21ade
Size 17.0MB
Sample260227-g4tdkset2e
SHA256 53e3b161de04d71adfe6b2757cac9c349cd4ff4b49fc9de5371d4dc3f6b21ade
MD5 2b0c600976c6a59c9aae2cd865440d87
SHA1 02327d14a63edc444126cc2f869efca9aa86bed8
SHA512 18564627a8547d46d223c70711b897817a4583e89f0f25c63eb4ef16cf1f3bb78c4988dad0788a0e02abdba3111cb8b46695b597b10659f1ff69345d1d57622c
SSDEEP 393216:QN6Q6o6Q6kCFBkTA5crrWQ8TbopWWdUMTInELfK:LQSQ6yAcrqQOopWWcGfK
TLSH
T15F07127BFB45B49EC4B2423785B48E3212477D59478396863C4CB6384B7B6EC4E1ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

trickmo

C2

http://havebeprotredo.at/243uwuyki

Targets

- Target
  53e3b161de04d71adfe6b2757cac9c349cd4ff4b49fc9de5371d4dc3f6b21ade
- Size 17.0MB
- SHA256 53e3b161de04d71adfe6b2757cac9c349cd4ff4b49fc9de5371d4dc3f6b21ade
- MD5 2b0c600976c6a59c9aae2cd865440d87
- SHA1 02327d14a63edc444126cc2f869efca9aa86bed8
- SHA512 18564627a8547d46d223c70711b897817a4583e89f0f25c63eb4ef16cf1f3bb78c4988dad0788a0e02abdba3111cb8b46695b597b10659f1ff69345d1d57622c
- SSDEEP 393216:QN6Q6o6Q6kCFBkTA5crrWQ8TbopWWdUMTInELfK:LQSQ6yAcrqQOopWWcGfK
- TLSH
  T15F07127BFB45B49EC4B2423785B48E3212477D59478396863C4CB6384B7B6EC4E1ABC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral1
- Target
  base.apk
- Size 8.2MB
- SHA256 20e62e70847193ab073d93868983759fb60c4089674615c7d5ff62e43cea3ecb
- MD5 c4d9dd5909c417566c3396963461369e
- SHA1 a19fdccaf8f82e9dc45d8eb5c2959896708343bc
- SHA512 af9f51a9b8515d6bebe066bf0d14c380657a18859f874fb030930ab3a9b34cd11a348e249be1359aa6e4cf9769acd88e02b92611b47b02a8332012990a6731d4
- SSDEEP 196608:VKzwiTM68UmaLAg1HlUFWqG/b8EkRAlAhCa5XS2Lv2hMc3JZgZ:V8j9+/iHKFZGQcsXSwehHfgZ
- TLSH
  T10D861203FF5AD49AC4B38A33CDB441350952AE5187C3D6471D5DB3AE287BAF0CA5AB84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion evasion execution trickmo impact infostealer persistence trojan
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral2