MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickMo


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
SHA3-384 hash: 93972ece5baa7c610ebdbd2e187c8abf7c783dd3ffde848ccfe443954e5ff8bea203647b1c7cc07d97681777650f5d18
SHA1 hash: 5dba368280da2df4c06202c0676eaed6edde58ee
MD5 hash: 854aac2d7aee697954fdece07fab9e63
humanhash: may-london-delta-carbon
File name:2.apk
Download: download sample
Signature TrickMo
Create hunting rule
File size:9'310'984 bytes
First seen:2025-01-28 10:19:41 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 196608:9AxUft/a8nInixZuwXQUkOGAsFuJS9C/pyuXjV6ijv5L9r:GSnIixZuuKsk98yuXRPRL1
TLSH T150961273F799622FC9E2C33715B95E32A153BE54C393960A18543378297BACC0F52AE4
TrID 35.5% (.APK) Android Package (27000/1/5)
18.4% (.ZIP) Opera Widget (14000/1/2)
17.7% (.JAR) Java Archive (13500/1/2)
13.8% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.2% (.MAFF) Mozilla Archive Format (gen) (7000/1/1)
Magika apk
Reporter Anonymous
Tags:apk TrickMo

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
PL PL
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6798af5739aa2bdf29b32fdf/reports/fe52db9d-299d-440c-9d9a-d1a8503bf86c/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
Score:
100%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7fd4a7ad1b5f67f588cfcdc7bb092d1c8aed71ffc9402f618f4562c3dadf8e1/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u76uu6wrwx3h6wem7tohxmes2hek5vy77skaf5qy6rlcypnn7dqq._file
Result
Malware family:
trickmo
Create hunting rule
Score:
  10/10
Tags:
family:trickmo android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
Link:
https://tria.ge/reports/250128-mc4ccsvrhz/
Behaviour
Checks CPU information
Checks memory information
Registers a broadcast receiver at runtime (usually for listening for system events)
Schedules tasks to execute at a specified time
Uses Crypto APIs (Might try to encrypt user data)
Queries the mobile country code (MCC)
Loads dropped Dex/Jar
Makes use of the framework's Accessibility service
Obtains sensitive information copied to the device clipboard
TrickMo
Trickmo family
Malware Config
C2 Extraction:
http://b-need-for-speed.online/u3n6hcu6te3b46gc
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b4faea9c-8bf2-431f-9d22-08e1df5a6b35
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments