trickmo | 0a26ca24c8dc561550876eb057c693eb32ede9d6d529f4f8a35e8a02a8074e1a

Analysis

max time kernel
20s
max time network
26s
platform
android-13_x64
resource
android-33-x64-arm64-20260306-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260306-enlocale:en-usos:android-13-x64system
submitted
14/03/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deper.apk
Size 8.1MB
Sample260314-e6lqeahv6m
SHA256 0a26ca24c8dc561550876eb057c693eb32ede9d6d529f4f8a35e8a02a8074e1a
MD5 34bf84d0a2075e5d984e2e431c7b1877
SHA1 b7dcade6384035bea5941b742998983a4d27c677
SHA512 fb9364c421618af548a45fc9dc61da17ecf32e23970d01fa9805d473cf3a8002ed347f9e270bda63c69f426774e093f9f798cc2f019e2495190a49098d48b78b
SSDEEP 196608:BqFg16ZkRb2DQS/ST8Y7bQoaDXanqtI0HR:eIpSaT8Y4ojr0HR
TLSH
T146861277F75AA62EC9E2833715B95E77A2537E08C343DA46241433782977ACC0F41AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion evasion execution trickmo impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

http://heyclodere.at/d3lbogxg4imyx

Signatures

TrickMo
TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
trojan infostealer banker trickmo
Trickmo family
trickmo

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/afex.pres905.sie/app_eight/gefyZjh.json	4554	afex.pres905.sie
/data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes2.dex	4554	afex.pres905.sie
/data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes3.dex	4554	afex.pres905.sie
/data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes4.dex	4554	afex.pres905.sie

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	afex.pres905.sie

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	afex.pres905.sie

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	afex.pres905.sie

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	afex.pres905.sie

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	afex.pres905.sie

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	afex.pres905.sie

afex.pres905.sie
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4554

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

gefyZjh.json

Path /data/data/afex.pres905.sie/app_eight/gefyZjh.json
Size 4.9MB
SHA256 cfac4d550fa7048f2854109adc80dd92ffeb909bdc18ac08c53fc173e44c9029
MD5 d71b6f24e6e3aff934dcfc442c2a244d
SHA1 9b161bb92d55da0b936eb0944bb49267bd961da9
SHA512 355ab34e4611c93890c9cb1a7f8e26eb8869cda857859c04bb41a92472a7f0a30f36c2747853323ff001ab1b713c32a9b782d90e78c96ae36d99de464895cad8
SSDEEP 98304:eM/z9usWLl6FrJSf2KHVV2jGHJLxg+FiK4ru3uGMw9WPIqCBu3P:7z4EJSfKGHVK+ERnw9y3mu3P
TLSH
T1B13633BD1A0CDB7B0C48DC46BF72597FB5DBBB98D203CA31D42A47D0A132A311959E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gefyZjh.json

Path /data/data/afex.pres905.sie/app_eight/gefyZjh.json
Size 4.9MB
SHA256 afd507acd9be4e6371de4b87f94fb02b56583cc37e8008a1c8021a1d859ff1d3
MD5 2330b690ee4dbaa6d82774b59412b14d
SHA1 a3dbe93c98acd5b67ef1ab6d1cd3f5f512d37f9f
SHA512 8d3fab7a59216f000a1e71ddc7f3af242c7914d14789873a49a7ec2282f753fe2c8b11140a96ba7a8332b3b6c3e28a5ec8625b513f91e3f5b51c35a5dd35eca2
SSDEEP 98304:VTSOhwrXiFwT9ScM2yx9ZGO1OuZxdGDpLUx2fmZwrRY8a0jHsVrBrbubdLn3:EIsiFA8p2mopLQBwTMzrbud3
TLSH
T1DA36336FEC3928FBF88E8AFE271B893D1DDA53D2509CD4EFC1261046210215FB9A5974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clicker.json

Path /data/data/afex.pres905.sie/cache/clicker.json
Size 18KB
SHA256 e48a44a9c840205fa2ffbf2b9390f9d744b7c36d75ab1d18747404fff9e6f270
MD5 aa942e28ed2a04bff7e7297b2f48ac23
SHA1 a711424ce00577dbb9b533596b8c8232f6312682
SHA512 408c5bb0538f111016370ce642dc2982ada7cb14fc61ef95588c8b18a49777cc7bd58a3a3d94412052701238daa1706bb594020ee285744d0ca2bc1f2d38094a
SSDEEP 384:5Ei5brlplvCVmC4RNaCSmtBcv5+4bgXPJDYF/ViD0tnheg8G1oLQZhZ:595brlpl6Vn4RNTSmtBcv5+40fJDy9kC
TLSH
T12092FE1BB6A52A37018F451C79AE41077D785289B3B0045DB91EAC982FBF0F05D93DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /data/data/afex.pres905.sie/databases/a
Size 20KB
SHA256 5d8e556cf9230390a2ea6e8fe0300bf0d3c28397a75d4d5d1138cf25713d5923
MD5 91af32c14839a2828ca58297e0861362
SHA1 bd758cc0bb47b570da2061d4633aa998a87ed971
SHA512 9810060201633366b6d13e9b81a2d9fe1adb61e027a215cd05454bbefaa7f6e1a17aae3781eedd8095a398a05f3c7cf03b589f29d1ac4789dfbf61bce25b9fb7
SSDEEP 6:l9bNFlq4yl18y4ATSFRdLumZyqfhEvgLudMBRERX4PBX4ogLugMBX4suuKfpqiOL:TLm8yNTSFbyiyuE9dMARmBEyPbAVOwG
TLSH
T13692D8C793006A0BC25D9673ACB583E10DB0511FD6E5DB47A4F518105E81A8464F1E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-journal

Path /data/data/afex.pres905.sie/databases/a-journal
Size 512B
SHA256 018025755ac0ca6d5cb4fdf880866eb76fbda8e8264b8daec2d0e91b001452ff
MD5 d923a34643856b96ea942bc38277bfe1
SHA1 baf7fdf74556fcb440a9060b84134ac4c1964140
SHA512 e759c4c2ee50a8c4433078b13f52ffc8504ef5f4e170b168b3e1d911636673323fc0a0ebde8fac4617c8c598b0fa7bfe01b879629035ff3fb95e8a7833a3a72c
MD5 SHA1 SHA512

Submit Download

a-journal

Path /data/data/afex.pres905.sie/databases/a-journal
Size 8KB
SHA256 341a03c431b64f1f5ae8fc10bf6b9c222f0e82f423af3bc9618b917ace568730
MD5 8605af850f9b90135e0cdadf283485ac
SHA1 eb82af2d9f9145d6b0c16d8dc56abb9fff8c96d7
SHA512 ec447d2768e21bf8c325c0e937f376ef05d5b63cb317006f4c96493b955c11291f1b093d36c14682e1fa0286634584537ce3fdafd1b29da8b6986833c0319c23
SSDEEP 6:7+/l9XYtGn1A/pg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKR:7+t1iRqLiuWd7RmBEyPbG
TLSH
T1EC02229C63800B13C8395AB790EE83400D01A7188262CB0B86E00C95AC8B4CCA8E9D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-journal

Path /data/data/afex.pres905.sie/databases/a-journal
Size 8KB
SHA256 099f8879718ef81a40769142fc84c91cd6550be3c46e545af6e7a487a5887550
MD5 6d336b5aa1039ff8c826870c26909357
SHA1 7b792d0405c3146c7fd51fad447c516cbf2c7aef
SHA512 c918c8811ea3c02326536a942c74831e8394a7a352c17eb227375e18a2638fd85322777656efd599d0164f3f2305cc03633805251c27bd96132f2a74e541058e
SSDEEP 6:7+/l9PcPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKGe/p:7+ttkqLJdKBRmBEyPbGp
TLSH
T1EF02C08C63400803C01E57F790EC83802E20A738D333CB87455008547C037CCE8D0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afex.pres905.sie

Path /data/data/afex.pres905.sie/files/afex.pres905.sie
Size 256B
SHA256 87ccb627dcbece415d6ee49c35c111b1619f032c505dd90be15e4467b73cb1e7
MD5 f3777cfb5c00eeef4404554c0b5a2bc0
SHA1 dc6d365dd30387b042f2b4eefad417ba99f68942
SHA512 81f24d63f0d23a7d25ecb560c11b2bec4c95e5d4b6cd79f39bb60f5b9394023315b2cbbe43337696cfec42d252c786945656bb09f6bc593ff5348ff95ce7e392
TLSH
T1B0D0EB02D2B08CCDA4982680A243C45953024204604A6CB2E1AAC12AA83E10EAC83682
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 036b8bb76f2f0b78e127ec0d662da08f0cc1714c2cce1c41ece7af68c143a260
MD5 e5b7de460ab5446d7a00396d26a6cb97
SHA1 4e0a7595a58d1b990ac801a0ce89a81ea260399f
SHA512 54a50ce478142be4ad209ab43b1a2be85e96dd859e7db1e541c0e0f1f8b6972031d61cd89d315febe7bc06eee64c7c2d776507c755e895261e0970b7490f8fc0
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 eec59e6d2d2fb6e0a8a66d8123a1afb484012a70dd550d1943712a98f10dec32
MD5 9bea58b9f52f5b01c312638cea017c9c
SHA1 d97ff39616f26ee3ee0f1c9115618e51132c7b1b
SHA512 1c90bcf47312d4d377a628aa5773f65921efdd32a7626855e4def4d836364ee25e45309f668595cad3f120745fe60640144be6654246f9c65839085af2e8a843
SSDEEP 24:oLTj5tYoHWDYQleu+iXOdJW69mIL5tYxcIKG+s:0P5tYoH8bleu+iXOfW6Ii5tYmh3s
TLSH
T1A7049BEFAA58F127DD271A3DB0A009F089382C144D2110F521B1FA33A6182A34E3F6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 666f8cfdd81aab315e428e4577bcf252599549004e934ffac544ba647eef96c3
MD5 aa5ef3e8a66b51d470954e6c2cb41b3d
SHA1 734d10907309cb161f94f18761e041e5259d0229
SHA512 ffb518a4ee365ad174a92ca4dadf2f090e4e459520260bb28b485033665d19651467bdb90ded9ecc686097fd899c03fdc219599715d0e76f618f482e9af6c016
SSDEEP 6:K2XMV6ZMVNFv9FZdKEAlOERX4PBX4ogLugMBX4suuK+/uMVpxtm6Z56xz7/+Ow2:KuZMzdKBRmBEyPbP/Lxk+Ow2
TLSH
T16C72C26653480D43CD05467674E9C3F69E2856098363D72B46503827AE413E9AE9CD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/afex.pres905.sie/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 9f0670c3529203bdd2efe477980f447640b2ed887498e4f35a69ef5b83c0f90a
MD5 cf95118cd55cc8ace15c2ca754ce6bc5
SHA1 d9788df96219bf9e265185b84657ec1d18cc56a8
SHA512 e0582c70bd215e994e64e240f006500b1b19087bc5d0049108dcb0d23b3211da8ff1ff4779c6f5975093580cd61951b18f270088dd354de07f1cc13e72b1fdb7
SSDEEP 48:uSY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9e:16+hdjnHtDRMpf8UzS6+BD8q0ExPfGc
TLSH
T1F5B3D04F0F1D2540C899A4F0B5A00FF1BA3E412E8793F3E169916077AEC5931DE29CB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gefyZjh.json

Path /data/user/0/afex.pres905.sie/app_eight/gefyZjh.json
Size 10.9MB
SHA256 6c84643bdddc36a15b515e72e8b768ba64ff6b8966492db9bce6660934f09746
MD5 35d4cda95e19e9be467673c78e1e2fa2
SHA1 3868d4dda794c360f57ba650c332b39ce5c68d8e
SHA512 577272d92633303f248c8545b67a5205489623ce44d746fcdc906ca29c0cdb26f83140f013510c356b709ead230da79fdd8b04654370a2c18275a3ac98344dd7
SSDEEP 98304:jhmCSO4PVOgEmK62Ij9R9c24ZV6gWt/srdcIzfaVIP0yvy:jhmCF1YFc24v6gcEzzfaVI8yvy
TLSH
T104B6AE12FB566C33C4AEA3366DFE03517B31A2AA7B0347562414D9F87CC32D61AA87C5
MD5 SHA1 SHA512 SSDEEP TLSH

Download

gefyZjh.json!classes2.dex

Path /data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes2.dex
Size 308KB
SHA256 f1fb65a096b1caf3b72a9cc99cf3f3019bad92f50ebfcaf24a11e3c99ade4837
MD5 9394cf9139f21d1eba50536e8da758f3
SHA1 d9ae02664755a8acc8e936b789687f57ae07e655
SHA512 8d972d5c3d5444d69ba91df20e66025074e1cfbe70941aa69f1d4c29cc995fd18facec74ec00e2c56da4f0997593b6e1db3feb02ba47332b8665d1a43324a97e
SSDEEP 6144:8W0J4addFlG6BMhG3Ta9T6Jm59qM3mWzVc/ZfXlPPiaDeVMOBFajoN:8WGqRJTT
TLSH
T1B16481096EC89D32C97F68377686036022A5D20053EDC747274B613F9DB35E85BDAA8F
MD5 SHA1 SHA512 SSDEEP TLSH

Download

gefyZjh.json!classes3.dex

Path /data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes3.dex
Size 265KB
SHA256 c1da85b67abf83fed10f13db2d25ab508b7978a9b6916d7e1653b7d96a318a44
MD5 82f4c71c21bac0a0a33af4ad6c6fcd9d
SHA1 5ddf4a4db7d610f4704bf51818ae12867685ee3e
SHA512 c530602b8733e337e71f4c8dbcbd73178393f796827e5f5dbf03a4066e593fbad0982d62ded4608363d657470014fa5fa90cdda083cd5eab4d56615d670845c1
SSDEEP 3072:Y7eHFisNZHcWX1LaGI4yMeFm0sDhDQ7FY1hjV1JnyVUInlP/V0A3rxxMU4VxXh24:w0FiwBIjjFmIYjdy/PN0pV+ug+
TLSH
T119443906F6816837DA99DB3E14F3D352BBB2E506EB13970B451CC4B62D82386AF431D9
MD5 SHA1 SHA512 SSDEEP TLSH

Download

gefyZjh.json!classes4.dex

Path /data/user/0/afex.pres905.sie/app_eight/gefyZjh.json!classes4.dex
Size 1.7MB
SHA256 c79795ea1d8f93d6471a6a10ae92f079fa7c79b0736de04edb53c5c5ae4862e4
MD5 30465152db261852e3a226a666ec4304
SHA1 442a188e07db85653022734d0a8537d4312aef38
SHA512 3b9b75f7030fa9280130172a7b1f17766b3399270ec49b899d7f4223e68ce7ee728a0ccd5217b98d276da8f84968f4d436b4e61c7fcd378c3be0a57f906dfa63
SSDEEP 24576:WTgpFQicl1kpEp3esHvee12K+EX3MNteOhNVtk5qYxvP:dpO1kpEp9eeOiEeOhNVtk5qYlP
TLSH
T10C858C22F6098B31DADE15B50DE763F9633163E7A1839302AE995948B9C3347C79C378
MD5 SHA1 SHA512 SSDEEP TLSH

Download

log.txt

Path /storage/emulated/0/Android/data/afex.pres905.sie/cache/logs/log.txt
Size 83B
SHA256 a81dc14011e6457021077f2bea2c03e2b4466c4c4ae85b5806758d4807700fde
MD5 ac1b8cc009b1441358d8927990b78af3
SHA1 3dfd3f4a849aee960091857a29d56c3da71904d9
SHA512 454e21d541802bde8672f609428360a96abf50e713c575d7db0dda805b6b2fa8e26bafbfdf5767b6d43e2d8bc7fab9bdd1138c99a7febbcef76e5f3ade24679e
TLSH
T1BDA0124701E009C304110241766560301B4D114B3680400D3C50709C83180C028EB840
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads