ginp | f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184

Analysis

max time kernel
1279827s
max time network
146s
platform
android_x86_64
resource
android-x86_64
submitted
19-03-2021 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184.apk
Size

2.7MB
MD5

894c537df61c9e9390fac65486db464f
SHA1

b59c6320e0cb6c35f8626104fc0baf7a04bd87a8
SHA256

f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184
SHA512

6bcce45ddbd0d5b49cad214c9025cebc40e50f70f991bee71422f060e8a96cc63fa415f882e55b7de63e6d9b4f3ad550b54d6ee49860f31dac4c4f23fb1e2697

Score

10^/10

ginp banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

ginp

http://fatgoose.top/api201/

http://purefoe.cc/api201/

http://nicemovement.top/api201/

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

net.quality.notice

pid process

3629 net.quality.notice

pid	process
3629	net.quality.notice

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

net.quality.notice

ioc	pid	process
/data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json	3629	net.quality.notice
/data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json	3629	net.quality.notice

Uses reflection 27 IoCs

obfuscation

Processes:

net.quality.notice

description	pid	process
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method android.content.res.AssetManager.addAssetPath	3629	net.quality.notice
Invokes method android.app.ContextImpl.getAssets	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method android.content.res.AssetManager.open	3629	net.quality.notice
Invokes method java.io.FilterInputStream.read	3629	net.quality.notice
Invokes method java.io.FilterInputStream.read	3629	net.quality.notice
Invokes method java.io.BufferedInputStream.read	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.io.BufferedInputStream.close	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.lang.String.getBytes	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.io.FileOutputStream.write	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.io.BufferedInputStream.close	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.io.FilterOutputStream.close	3629	net.quality.notice
Invokes method android.app.ActivityThread.currentActivityThread	3629	net.quality.notice
Acesses field android.app.ActivityThread.mPackages	3629	net.quality.notice
Invokes method java.lang.reflect.Field.get	3629	net.quality.notice
Invokes method java.lang.Object.getClass	3629	net.quality.notice
Invokes method java.lang.ref.Reference.get	3629	net.quality.notice
Invokes method java.lang.ref.Reference.get	3629	net.quality.notice
Acesses field android.app.LoadedApk.mClassLoader	3629	net.quality.notice
Invokes method java.lang.reflect.Field.get	3629	net.quality.notice
Acesses field android.app.LoadedApk.mClassLoader	3629	net.quality.notice

net.quality.notice
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:3629

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads