cf7072af58c9f9b6659ff0399238b46bd5e00757d97f05ebb7aa5def9d7e8cf9

General
Target

cf7072af58c9f9b6659ff0399238b46bd5e00757d97f05ebb7aa5def9d7e8cf9.apk

Filesize

2MB

Completed

19-03-2021 21:00

Score
10 /10
MD5

70631fb6b1230cdf37297cd4663ee3f7

SHA1

b3afc81d7e6e0c76dd384ded11cb132948888bba

SHA256

cf7072af58c9f9b6659ff0399238b46bd5e00757d97f05ebb7aa5def9d7e8cf9

Malware Config

Extracted

Family ginp
C2

http://fatgoose.top/api201/

http://purefoe.cc/api201/

Signatures 4

Filter: none

  • Ginp

    Description

    Ginp is an android banking trojan first seen in mid 2019.

  • Removes its main activity from the application launcher
    perfect.purpose.announce

    Reported IOCs

    pidprocess
    4524perfect.purpose.announce
  • Loads dropped Dex/Jar
    perfect.purpose.announce

    Description

    Runs executable file dropped to the device during analysis.

    Reported IOCs

    iocpidprocess
    /data/user/0/perfect.purpose.announce/app_DynamicOptDex/MWHheST.json4524perfect.purpose.announce
    /data/user/0/perfect.purpose.announce/app_DynamicOptDex/MWHheST.json4524perfect.purpose.announce
  • Uses reflection
    perfect.purpose.announce

    Reported IOCs

    descriptionpidprocess
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method android.content.res.AssetManager.addAssetPath4524perfect.purpose.announce
    Invokes method android.app.ContextImpl.getAssets4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method android.content.res.AssetManager.open4524perfect.purpose.announce
    Invokes method java.io.FilterInputStream.read4524perfect.purpose.announce
    Invokes method java.io.FilterInputStream.read4524perfect.purpose.announce
    Invokes method java.io.BufferedInputStream.read4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.io.BufferedInputStream.close4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.lang.String.getBytes4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.io.FileOutputStream.write4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.io.BufferedInputStream.close4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.io.FilterOutputStream.close4524perfect.purpose.announce
    Invokes method android.app.ActivityThread.currentActivityThread4524perfect.purpose.announce
    Acesses field android.app.ActivityThread.mPackages4524perfect.purpose.announce
    Invokes method java.lang.reflect.Field.get4524perfect.purpose.announce
    Invokes method java.lang.Object.getClass4524perfect.purpose.announce
    Invokes method java.lang.ref.Reference.get4524perfect.purpose.announce
    Invokes method java.lang.ref.Reference.get4524perfect.purpose.announce
    Acesses field android.app.LoadedApk.mClassLoader4524perfect.purpose.announce
    Invokes method java.lang.reflect.Field.get4524perfect.purpose.announce
    Acesses field android.app.LoadedApk.mClassLoader4524perfect.purpose.announce
Processes 1
  • perfect.purpose.announce
    Removes its main activity from the application launcher
    Loads dropped Dex/Jar
    Uses reflection
    PID:4524
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads