trickmo

General

Target
InstPizza.apk
Size 12.6MB
Sample260314-e6lqeahv6m
SHA256 ac21ddc972b50c66a9876f1a470f0a29f4df58c1557b8fa0ba649fc0b255dd37
MD5 f2cfdf73a58d7b72c17076d172a5dbc4
SHA1 7954dfa77e92b8bf16f7d3e598aea3c02017bcd5
SHA512 d96cb049f3a5174907e2acb8a723ef341f6dc11a1070fc4f7d5738752ccbeb361b5c5b27a5bc16917647cb791068fdd1e512dee56e3853bcdb70a74d31482e3e
SSDEEP 196608:49g50p5SBomd9vG4NW1WGzBcAKj/qtOLqOTWqVxszqXI/AfTGYayi6SOHgzeg:49wnU4Q1WGCAHZOTW6lXI/AfPSOHq
TLSH
T1A7D61267F708992FC4F342B38979076222475C26874386D76954723C18BBAD82E9DFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

trickmo

C2

http://heyclodere.at/d3lbogxg4imyx

Targets

- Target
  InstPizza.apk
- Size 12.6MB
- SHA256 ac21ddc972b50c66a9876f1a470f0a29f4df58c1557b8fa0ba649fc0b255dd37
- MD5 f2cfdf73a58d7b72c17076d172a5dbc4
- SHA1 7954dfa77e92b8bf16f7d3e598aea3c02017bcd5
- SHA512 d96cb049f3a5174907e2acb8a723ef341f6dc11a1070fc4f7d5738752ccbeb361b5c5b27a5bc16917647cb791068fdd1e512dee56e3853bcdb70a74d31482e3e
- SSDEEP 196608:49g50p5SBomd9vG4NW1WGzBcAKj/qtOLqOTWqVxszqXI/AfTGYayi6SOHgzeg:49wnU4Q1WGCAHZOTW6lXI/AfPSOHq
- TLSH
  T1A7D61267F708992FC4F342B38979076222475C26874386D76954723C18BBAD82E9DFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  deper.apk
- Size 8.1MB
- SHA256 0a26ca24c8dc561550876eb057c693eb32ede9d6d529f4f8a35e8a02a8074e1a
- MD5 34bf84d0a2075e5d984e2e431c7b1877
- SHA1 b7dcade6384035bea5941b742998983a4d27c677
- SHA512 fb9364c421618af548a45fc9dc61da17ecf32e23970d01fa9805d473cf3a8002ed347f9e270bda63c69f426774e093f9f798cc2f019e2495190a49098d48b78b
- SSDEEP 196608:BqFg16ZkRb2DQS/ST8Y7bQoaDXanqtI0HR:eIpSaT8Y4ojr0HR
- TLSH
  T146861277F75AA62EC9E2833715B95E77A2537E08C343DA46241433782977ACC0F41AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion evasion execution trickmo impact infostealer persistence trojan
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral2