ginp | d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6

Analysis

max time kernel
1277493s
max time network
154s
platform
android_x86_64
resource
android-x86_64_arm64
submitted
19-03-2021 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6.apk
Size

2.7MB
MD5

7799e85be23f5fed2e64d203b4e19e3d
SHA1

4f5c820d05f35b709998df8b32c3709e5f41c9b6
SHA256

d942c3d08dfa85df1a6ac89e6e6033eeb0cf87ec2f43ed46f1dbf43df40d2df6
SHA512

aff1261bb10ea479fd0db9c913b787fbc91195f4d18973e52ac02fa49e4ec8e52c2c8396412ce7b68aa5f46370a3a2f7a38617a454ae4e3ca491ca3d7140c262

Score

10^/10

ginp banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

ginp

http://fatgoose.top/api201/

http://purefoe.cc/api201/

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

pattern.patient.heart

pid process

4504 pattern.patient.heart

pid	process
4504	pattern.patient.heart

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

pattern.patient.heart

ioc	pid	process
/data/user/0/pattern.patient.heart/app_DynamicOptDex/OLNhWJb.json	4504	pattern.patient.heart
/data/user/0/pattern.patient.heart/app_DynamicOptDex/OLNhWJb.json	4504	pattern.patient.heart

Uses reflection 27 IoCs

obfuscation

Processes:

pattern.patient.heart

description	pid	process
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method android.content.res.AssetManager.addAssetPath	4504	pattern.patient.heart
Invokes method android.app.ContextImpl.getAssets	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method android.content.res.AssetManager.open	4504	pattern.patient.heart
Invokes method java.io.FilterInputStream.read	4504	pattern.patient.heart
Invokes method java.io.FilterInputStream.read	4504	pattern.patient.heart
Invokes method java.io.BufferedInputStream.read	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.io.BufferedInputStream.close	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.lang.String.getBytes	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.io.FileOutputStream.write	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.io.BufferedInputStream.close	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.io.FilterOutputStream.close	4504	pattern.patient.heart
Invokes method android.app.ActivityThread.currentActivityThread	4504	pattern.patient.heart
Acesses field android.app.ActivityThread.mPackages	4504	pattern.patient.heart
Invokes method java.lang.reflect.Field.get	4504	pattern.patient.heart
Invokes method java.lang.Object.getClass	4504	pattern.patient.heart
Invokes method java.lang.ref.Reference.get	4504	pattern.patient.heart
Invokes method java.lang.ref.Reference.get	4504	pattern.patient.heart
Acesses field android.app.LoadedApk.mClassLoader	4504	pattern.patient.heart
Invokes method java.lang.reflect.Field.get	4504	pattern.patient.heart
Acesses field android.app.LoadedApk.mClassLoader	4504	pattern.patient.heart

pattern.patient.heart
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4504

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads