Analysis
-
max time kernel
1279827s -
max time network
146s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
19-03-2021 20:55
Static task
static1
Behavioral task
behavioral1
Sample
f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184.apk
Resource
android-x86_64
General
-
Target
f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184.apk
-
Size
2.7MB
-
MD5
894c537df61c9e9390fac65486db464f
-
SHA1
b59c6320e0cb6c35f8626104fc0baf7a04bd87a8
-
SHA256
f9e0fd26bdf1ef7a5cc255616368c8d0df6bb68e4d787e3bc1cee1b104f05184
-
SHA512
6bcce45ddbd0d5b49cad214c9025cebc40e50f70f991bee71422f060e8a96cc63fa415f882e55b7de63e6d9b4f3ad550b54d6ee49860f31dac4c4f23fb1e2697
Malware Config
Extracted
ginp
http://fatgoose.top/api201/
http://purefoe.cc/api201/
http://nicemovement.top/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Processes:
net.quality.noticepid process 3629 net.quality.notice -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
net.quality.noticeioc pid process /data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json 3629 net.quality.notice /data/user/0/net.quality.notice/app_DynamicOptDex/dUNteYu.json 3629 net.quality.notice -
Uses reflection 27 IoCs
Processes:
net.quality.noticedescription pid process Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method android.content.res.AssetManager.addAssetPath 3629 net.quality.notice Invokes method android.app.ContextImpl.getAssets 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method android.content.res.AssetManager.open 3629 net.quality.notice Invokes method java.io.FilterInputStream.read 3629 net.quality.notice Invokes method java.io.FilterInputStream.read 3629 net.quality.notice Invokes method java.io.BufferedInputStream.read 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.BufferedInputStream.close 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.lang.String.getBytes 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.FileOutputStream.write 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.BufferedInputStream.close 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.io.FilterOutputStream.close 3629 net.quality.notice Invokes method android.app.ActivityThread.currentActivityThread 3629 net.quality.notice Acesses field android.app.ActivityThread.mPackages 3629 net.quality.notice Invokes method java.lang.reflect.Field.get 3629 net.quality.notice Invokes method java.lang.Object.getClass 3629 net.quality.notice Invokes method java.lang.ref.Reference.get 3629 net.quality.notice Invokes method java.lang.ref.Reference.get 3629 net.quality.notice Acesses field android.app.LoadedApk.mClassLoader 3629 net.quality.notice Invokes method java.lang.reflect.Field.get 3629 net.quality.notice Acesses field android.app.LoadedApk.mClassLoader 3629 net.quality.notice