trickmo | a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1 | Triage™

Login
Reports

Overview

overview

Static

static

6

2.apk

android-9-x86

2.apk

android-10-x64

2.apk

android-11-x64

Sharing

Copy URL Twitter E-mail

General

Target
2.apk
Size 8.9MB
Sample250128-mc4ccsvrhz
SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
MD5 854aac2d7aee697954fdece07fab9e63
SHA1 5dba368280da2df4c06202c0676eaed6edde58ee
SHA512 fd6f066ed74ef83daadd90bfc9f0fb925063b398bcb5bfc2d14f70058b1bd899ebeed72c21e401d7ae8ef132366ec11e8b8b700ac5c447f6b02ca14cbb9a891a
SSDEEP 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickmo android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

2.apk

Resource

android-x86-arm-20240624-en

android-9-x86

10 signatures

150 seconds

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Behavioral task

behavioral2

Sample

2.apk

Resource

android-x64-20240624-en

android-10-x64

11 signatures

150 seconds

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Behavioral task

behavioral3

Sample

2.apk

Resource

android-x64-arm64-20240624-en

android-11-x64

9 signatures

150 seconds

trickmo banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Extracted

Family

trickmo

C2

http://b-need-for-speed.online/u3n6hcu6te3b46gc

Targets

- Target
  2.apk
- Size 8.9MB
- SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
- MD5 854aac2d7aee697954fdece07fab9e63
- SHA1 5dba368280da2df4c06202c0676eaed6edde58ee
- SHA512 fd6f066ed74ef83daadd90bfc9f0fb925063b398bcb5bfc2d14f70058b1bd899ebeed72c21e401d7ae8ef132366ec11e8b8b700ac5c447f6b02ca14cbb9a891a
- SSDEEP 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

trickmo banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- TrickMo
  TrickMo is an Android banking trojan with the capability to intercept 2FA codes first seen in September 2019.
  trojan infostealer banker trickmo
- Trickmo family
  trickmo
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Input Injection

Tasks

static1

behavioral1

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

behavioral2

trickmobankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencetrojan

behavioral3

trickmobankercollectioncredential_accessdefense_evasionevasionexecutionimpactinfostealerpersistencetrojan

© 2018-2026

Terms | Privacy