Analysis
-
max time kernel
179s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
22-06-2024 23:30
Static task
static1
Behavioral task
behavioral1
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
-
Size
2.3MB
-
MD5
363232356841fae677c850fb78c29b24
-
SHA1
e9ab678b80a2ba4bf5a3e98bd2bfd41de67ba616
-
SHA256
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b
-
SHA512
9eb11136b1caaadada18dcfab684a7228836493d4bf1608c47514d267471be21dc58732c17fac1d1265549d6314dcdb345b222c748941e41dc35d5593df3b609
-
SSDEEP
49152:VYUwxqJIcFqgnhr+LJG5olrJbeh2OwcoLpVioKNsuuh11UxSlAUUZEFN:VY/xqJhsgnhrmGmlZehi3pVokTNlUZEj
Malware Config
Extracted
ginp
2.8d
mp43
http://sorryfordelay.top/
http://silverball.cc/
-
uri
api201
Extracted
ginp
http://sorryfordelay.top/api201/
http://silverball.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
soldier.unhappy.garageioc pid process /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 4189 soldier.unhappy.garage /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 4189 soldier.unhappy.garage -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId soldier.unhappy.garage -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock soldier.unhappy.garage -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground soldier.unhappy.garage -
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
soldier.unhappy.garageioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo soldier.unhappy.garage -
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS soldier.unhappy.garage -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS soldier.unhappy.garage -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS soldier.unhappy.garage
Processes
-
soldier.unhappy.garage1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD53be84dc3eea625b9f0debe41f642e1b0
SHA10590fd9d43ce7a9ac1afa257111fd799dbced9ef
SHA256351a0ff5546ba77d8bc784f29a4df8227cc254b872c47105a11eb3d5b43c90d9
SHA51252e4f4f048fca240502ef9b0488bd6c5c4b8c99e3d94a395d90fae736e774734c4f7457b9946111538ed5a3d3b1f34addd640199c26407bb7df4c73aca1cdf06
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD585c5d55c3a906bef6658d9613816d2b1
SHA12507b240dfcf7f5e16a85b6fa8ea99562f2a3d3c
SHA2568ad39fadaacb0a5a56e87222a534cd23282971ef094d1122dcd5dc1edf84d3f0
SHA512d7ef69c2d47cf4b9f50b119a448d9547e8514ab11180f9c14df9f563047b0f5041d5c0332574317f220876b480a3c2df3784a28d4ea6a6ac54b6c5bd1d82d2a6
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/oat/Tp.json.cur.profFilesize
345B
MD5c4098aa2327a62332c408a4107ffaaec
SHA139b8c34d124eda18a1388ecf729de94f166ad0ea
SHA256dd53605f1c41e3e7167889568edb7aaacb61420c875b1c8b73708847fe23ea7a
SHA51221213a98df859fb01049e8f4c0d08eff7e63723e2915f6332b4f8b64e68c3fca43ab425ab3a616694e115bd6f07c2b0bacca9a6530c2a287afc8775c93da3888