Analysis
-
max time kernel
1277493s -
max time network
154s -
platform
android_x86_64 -
resource
android-x86_64_arm64 -
submitted
19-03-2021 20:17
Static task
static1
Behavioral task
behavioral1
Sample
d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6.apk
Resource
android-x86_64_arm64
android_x86_64
0 signatures
0 seconds
General
-
Target
d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6.apk
-
Size
2.7MB
-
MD5
7799e85be23f5fed2e64d203b4e19e3d
-
SHA1
4f5c820d05f35b709998df8b32c3709e5f41c9b6
-
SHA256
d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6
-
SHA512
aff1261bb10ea479fd0db9c913b787fbc91195f4d18973e52ac02fa49e4ec8e52c2c8396412ce7b68aa5f46370a3a2f7a38617a454ae4e3ca491ca3d7140c262
Score
10/10
Malware Config
Extracted
Family
ginp
C2
http://fatgoose.top/api201/
http://purefoe.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
pid Process 4504 pattern.patient.heart -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/pattern.patient.heart/app_DynamicOptDex/OLNhWJb.json 4504 pattern.patient.heart /data/user/0/pattern.patient.heart/app_DynamicOptDex/OLNhWJb.json 4504 pattern.patient.heart -
Uses reflection 27 IoCs
description pid Process Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method android.content.res.AssetManager.addAssetPath 4504 pattern.patient.heart Invokes method android.app.ContextImpl.getAssets 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method android.content.res.AssetManager.open 4504 pattern.patient.heart Invokes method java.io.FilterInputStream.read 4504 pattern.patient.heart Invokes method java.io.FilterInputStream.read 4504 pattern.patient.heart Invokes method java.io.BufferedInputStream.read 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.io.BufferedInputStream.close 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.lang.String.getBytes 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.io.FileOutputStream.write 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.io.BufferedInputStream.close 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.io.FilterOutputStream.close 4504 pattern.patient.heart Invokes method android.app.ActivityThread.currentActivityThread 4504 pattern.patient.heart Acesses field android.app.ActivityThread.mPackages 4504 pattern.patient.heart Invokes method java.lang.reflect.Field.get 4504 pattern.patient.heart Invokes method java.lang.Object.getClass 4504 pattern.patient.heart Invokes method java.lang.ref.Reference.get 4504 pattern.patient.heart Invokes method java.lang.ref.Reference.get 4504 pattern.patient.heart Acesses field android.app.LoadedApk.mClassLoader 4504 pattern.patient.heart Invokes method java.lang.reflect.Field.get 4504 pattern.patient.heart Acesses field android.app.LoadedApk.mClassLoader 4504 pattern.patient.heart