Analysis
-
max time kernel
53s -
max time network
40s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
23-06-2024 03:20
Static task
static1
Behavioral task
behavioral1
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
-
Size
2.3MB
-
MD5
363232356841fae677c850fb78c29b24
-
SHA1
e9ab678b80a2ba4bf5a3e98bd2bfd41de67ba616
-
SHA256
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b
-
SHA512
9eb11136b1caaadada18dcfab684a7228836493d4bf1608c47514d267471be21dc58732c17fac1d1265549d6314dcdb345b222c748941e41dc35d5593df3b609
-
SSDEEP
49152:VYUwxqJIcFqgnhr+LJG5olrJbeh2OwcoLpVioKNsuuh11UxSlAUUZEFN:VY/xqJhsgnhrmGmlZehi3pVokTNlUZEj
Malware Config
Extracted
ginp
2.8d
mp43
http://sorryfordelay.top/
http://silverball.cc/
-
uri
api201
Extracted
ginp
http://sorryfordelay.top/api201/
http://silverball.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
soldier.unhappy.garage/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/oat/x86/Tp.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 4272 soldier.unhappy.garage /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 4350 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/oat/x86/Tp.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 4272 soldier.unhappy.garage -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId soldier.unhappy.garage -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock soldier.unhappy.garage -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground soldier.unhappy.garage -
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
soldier.unhappy.garageioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo soldier.unhappy.garage -
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS soldier.unhappy.garage -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS soldier.unhappy.garage -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS soldier.unhappy.garage
Processes
-
soldier.unhappy.garage1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/oat/x86/Tp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD53be84dc3eea625b9f0debe41f642e1b0
SHA10590fd9d43ce7a9ac1afa257111fd799dbced9ef
SHA256351a0ff5546ba77d8bc784f29a4df8227cc254b872c47105a11eb3d5b43c90d9
SHA51252e4f4f048fca240502ef9b0488bd6c5c4b8c99e3d94a395d90fae736e774734c4f7457b9946111538ed5a3d3b1f34addd640199c26407bb7df4c73aca1cdf06
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD585c5d55c3a906bef6658d9613816d2b1
SHA12507b240dfcf7f5e16a85b6fa8ea99562f2a3d3c
SHA2568ad39fadaacb0a5a56e87222a534cd23282971ef094d1122dcd5dc1edf84d3f0
SHA512d7ef69c2d47cf4b9f50b119a448d9547e8514ab11180f9c14df9f563047b0f5041d5c0332574317f220876b480a3c2df3784a28d4ea6a6ac54b6c5bd1d82d2a6
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/oat/Tp.json.cur.profFilesize
331B
MD5205105c2cc3e783b416cb6be951f1724
SHA1a65888e6970092f4c39f4dfca2bfcec788a54b9d
SHA256658421dd3b7acabcd21b432ab3e40c3ddcdaceb86b62ddf6e8694d7506a5a918
SHA512afd94f75506508b47d242d5c3206c13e5f2b56e25e18d353b7f1812823f750b130804675ff77c7c61d0e5a1026cb434b410fc573853a7c1077fd91358179047b
-
/data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD5ed3d506a0f83f5748b62dfb3f2cf4bb5
SHA18a5a0d7e0119726d9af53bbb1138de8f20abda68
SHA2567228481b0d4ba8d742c6b7d5e0f1b3e9bf05fc4840e9a253592e9b0317beb545
SHA5129a2fc150a0b074a723ea3d3d2d3aab3d0676e2a2cf403304af5c2e9a2c8b22f461ba925183b715fb638c0bba7d93d8557a4e35a6ad030067be17bbbf6df8d3fc