General

  • Target

    1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4

  • Size

    3.3MB

  • Sample

    210415-4dwxw159p2

  • MD5

    e91a4f5ee37250bbed681e905db28ee6

  • SHA1

    62d1d459be8520899469115d8cc2802b4e172b31

  • SHA256

    1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4

  • SHA512

    137ceec28702532a2ef281dbed31d22b8244d57074d7f3bf12ebfafe5a07d87d83ab0b855b7ef369fed84b7bed2d0c208ff85925a03e2f5f45672e67ee19f7ea

Malware Config

Extracted

Family

ginp

C2

http://bigballgame.top/api201/

http://jackblack.cc/api201/

http://sweetseventeen.top/api201/

Targets

    • Target

      1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4

    • Size

      3.3MB

    • MD5

      e91a4f5ee37250bbed681e905db28ee6

    • SHA1

      62d1d459be8520899469115d8cc2802b4e172b31

    • SHA256

      1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4

    • SHA512

      137ceec28702532a2ef281dbed31d22b8244d57074d7f3bf12ebfafe5a07d87d83ab0b855b7ef369fed84b7bed2d0c208ff85925a03e2f5f45672e67ee19f7ea

    • Ginp

      Ginp is an android banking trojan first seen in mid 2019.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks