Analysis
- max time kernel
1279827s - max time network
146s - platform
android_x86_64 - resource
android-x86_64 - submitted
19/03/2021, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
- Target f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184.apk
- Size 2.7MB
- Sample210319-abewf1vxbe
- SHA256 f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184
- MD5 894c537df61c9e9390fac65486db464f
- SHA1 b59c6320e0cb6c35f8626104fc0baf7a04bd87a8
- SHA512 6bcce45ddbd0d5b49cad214c9025cebc40e50f70f991bee71422f060e8a96cc63fa415f882e55b7de63e6d9b4f3ad550b54d6ee49860f31dac4c4f23fb1e2697
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
ginp
C2
-
http://fatgoose.top/api201/
-
http://purefoe.cc/api201/
-
http://nicemovement.top/api201/
Signatures
- Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
pid Process 3629 net.quality.notice - Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json 3629 net.quality.notice /data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json 3629 net.quality.notice - Uses reflection 27 IoCs
description pid Process Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method android.content.res.AssetManager.addAssetPath 3629 net.quality.notice Invokes method android.app.ContextImpl.getAssets 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method android.content.res.AssetManager.open 3629 net.quality.notice Invokes method java.io.FilterInputStream.read 3629 net.quality.notice Invokes method java.io.FilterInputStream.read 3629 net.quality.notice Invokes method java.io.BufferedInputStream.read 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.BufferedInputStream.close 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.lang.String.getBytes 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.FileOutputStream.write 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.BufferedInputStream.close 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.FilterOutputStream.close 3629 net.quality.notice Invokes method android.app.ActivityThread.currentActivityThread 3629 net.quality.notice Acesses field android.app.ActivityThread.mPackages 3629 net.quality.notice Invokes method java.lang.reflect.Field.get 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.lang.ref.Reference.get 3629 net.quality.notice Invokes method java.lang.ref.Reference.get 3629 net.quality.notice Acesses field android.app.LoadedApk.mClassLoader 3629 net.quality.notice Invokes method java.lang.reflect.Field.get 3629 net.quality.notice Acesses field android.app.LoadedApk.mClassLoader 3629 net.quality.notice