ginp | 1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4

Analysis

max time kernel
3571905s
max time network
154s
platform
android_x86
resource
android-x86_arm
submitted
15-04-2021 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4.apk
Size

3.3MB
MD5

e91a4f5ee37250bbed681e905db28ee6
SHA1

62d1d459be8520899469115d8cc2802b4e172b31
SHA256

1c00a0bd53a4f42bd3eaf36bac4ee593e57cce5b02f3ac8fe6139338abbe3ab4
SHA512

137ceec28702532a2ef281dbed31d22b8244d57074d7f3bf12ebfafe5a07d87d83ab0b855b7ef369fed84b7bed2d0c208ff85925a03e2f5f45672e67ee19f7ea

Score

10^/10

ginp banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

ginp

http://bigballgame.top/api201/

http://jackblack.cc/api201/

http://sweetseventeen.top/api201/

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4712	lounge.margin.member

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/lounge.margin.member/app_DynamicOptDex/peCpJj.json	4712	lounge.margin.member

Uses reflection 27 IoCs

obfuscation

description	pid	Process
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method android.content.res.AssetManager.addAssetPath	4712	lounge.margin.member
Invokes method android.app.ContextImpl.getAssets	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method android.content.res.AssetManager.open	4712	lounge.margin.member
Invokes method java.io.FilterInputStream.read	4712	lounge.margin.member
Invokes method java.io.FilterInputStream.read	4712	lounge.margin.member
Invokes method java.io.BufferedInputStream.read	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.io.BufferedInputStream.close	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.lang.String.getBytes	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.io.FileOutputStream.write	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.io.BufferedInputStream.close	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.io.FilterOutputStream.close	4712	lounge.margin.member
Invokes method android.app.ActivityThread.currentActivityThread	4712	lounge.margin.member
Acesses field android.app.ActivityThread.mPackages	4712	lounge.margin.member
Invokes method java.lang.reflect.Field.get	4712	lounge.margin.member
Invokes method java.lang.Object.getClass	4712	lounge.margin.member
Invokes method java.lang.ref.Reference.get	4712	lounge.margin.member
Invokes method java.lang.ref.Reference.get	4712	lounge.margin.member
Acesses field android.app.LoadedApk.mClassLoader	4712	lounge.margin.member
Invokes method java.lang.reflect.Field.get	4712	lounge.margin.member
Acesses field android.app.LoadedApk.mClassLoader	4712	lounge.margin.member

lounge.margin.member
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4712

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads