Overview

overview

10

Static

static

7

392d9c1f05...38.apk

android-9-x86

10

392d9c1f05...38.apk

android-10-x64

10

392d9c1f05...38.apk

android-11-x64

10

Certificat...g.html

windows7-x64

1

Certificat...g.html

windows10-2004-x64

1

FileBrowser.html

windows7-x64

1

FileBrowser.html

windows10-2004-x64

1

MediaPlatform.js

windows7-x64

1

MediaPlatform.js

windows10-2004-x64

1

OPENLCS.js

windows7-x64

1

OPENLCS.js

windows10-2004-x64

1

POLITICAS.html

windows7-x64

1

POLITICAS.html

windows10-2004-x64

1

WeReadApi.js

windows7-x64

1

WeReadApi.js

windows10-2004-x64

1

YTPlayerVi...r.html

windows7-x64

1

YTPlayerVi...r.html

windows10-2004-x64

1

angular-tr...min.js

windows7-x64

1

angular-tr...min.js

windows10-2004-x64

1

angular.sa...min.js

windows7-x64

1

angular.sa...min.js

windows10-2004-x64

1

apimiddleware.js

windows7-x64

1

apimiddleware.js

windows10-2004-x64

1

app.js

windows7-x64

1

app.js

windows10-2004-x64

1

base.js

windows7-x64

1

base.js

windows10-2004-x64

1

blank.html

windows7-x64

1

blank.html

windows10-2004-x64

1

bootstrap.min.js

windows7-x64

1

bootstrap.min.js

windows10-2004-x64

1

chmod.js

windows7-x64

1

Analysis

  • max time kernel
    3518036s
  • max time network
    143s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
  • submitted
    07-08-2023 20:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    392d9c1f05d8f8d67fbca464690af0d925046f05edbb75087b16c277627b5238.apk

  • Size

    2.4MB

  • MD5

    e2ee98f1ec1e546acfd90372f4855975

  • SHA1

    cd0ad67c662d53401d1cfc1cac01e38eef187b7c

  • SHA256

    392d9c1f05d8f8d67fbca464690af0d925046f05edbb75087b16c277627b5238

  • SHA512

    a3f22aeb971b15c40aa2ecdde9d98fba6e6240775770097990871bcd44d594e8511e5bf80cf4cf3845711afdc55b16c0a1b92a80a25b0e9380bc915f5c67648b

  • SSDEEP

    49152:ALWsSzhcy0kpJD63pfaGHbVQTgAW0DUGWv6+nVTi6gEDiw2OCIt2W:ArBy0kXhM5QsIDYBVbgEmlEQW

Score
10/10
ginpmp74bankerevasioninfostealertrojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp74

C2

http://gunfirebob.top/

http://jackblack.cc/
Attributes
  • uri

    api201

Extracted

Family

ginp

C2

http://gunfirebob.top/api201/

http://jackblack.cc/api201/

Signatures

  • Ginp

    Ginp is an android banking trojan first seen in mid 2019.

    bankertrojaninfostealerginp
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • unknown.decline.return
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4325

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/unknown.decline.return/app_DynamicOptDex/RxLyO.json
    Filesize

    487KB

    MD5

    399ad44f3cc66c9f1d473882d75db038

    SHA1

    2bda8a9f0f9f59e40b28eddd444d08c3cb0cec82

    SHA256

    1f563937a4ff9e143e0b00032376875c7cfe2d76e14d0675585b1bd2adee98d6

    SHA512

    35ce54d7768cf49f7344ffba65ec6a2ca55fcc68fe9d6f8d50e68d6a87b38e38ae504ada75c44173a380b89afbd395dec1a2e1c0751b51e967386df8425737a7

    Download Submit

  • /data/user/0/unknown.decline.return/app_DynamicOptDex/RxLyO.json
    Filesize

    487KB

    MD5

    f0141bbe2b96842a489d9a97d7377658

    SHA1

    e5d6c7d6c487e8fcfcfd593d3d63e55f37026aeb

    SHA256

    356ab89ed459e9a7cbb9b39ebe9d2aabc0991cb1308bdba3c645a01ee93093ce

    SHA512

    0c0e42b8196974a6958990e3324d10ef255e4ec9642fd6c397ae6dda9c7c0abecbe6559ddb4b79fb7154ee42904d12c4dd300a1ed1483113f6c0d7802eaa975d

    Download Submit

  • /data/user/0/unknown.decline.return/app_DynamicOptDex/RxLyO.json
    Filesize

    487KB

    MD5

    f0141bbe2b96842a489d9a97d7377658

    SHA1

    e5d6c7d6c487e8fcfcfd593d3d63e55f37026aeb

    SHA256

    356ab89ed459e9a7cbb9b39ebe9d2aabc0991cb1308bdba3c645a01ee93093ce

    SHA512

    0c0e42b8196974a6958990e3324d10ef255e4ec9642fd6c397ae6dda9c7c0abecbe6559ddb4b79fb7154ee42904d12c4dd300a1ed1483113f6c0d7802eaa975d

    Download Submit

  • /data/user/0/unknown.decline.return/app_DynamicOptDex/oat/RxLyO.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit