Analysis
-
max time kernel
66s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system -
submitted
23-06-2024 03:20
Static task
static1
Behavioral task
behavioral1
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b.apk
-
Size
2.3MB
-
MD5
363232356841fae677c850fb78c29b24
-
SHA1
e9ab678b80a2ba4bf5a3e98bd2bfd41de67ba616
-
SHA256
d95dff4e52801d7a1399126fcb1617ff0829cf0916530357caef7d0dfd73578b
-
SHA512
9eb11136b1caaadada18dcfab684a7228836493d4bf1608c47514d267471be21dc58732c17fac1d1265549d6314dcdb345b222c748941e41dc35d5593df3b609
-
SSDEEP
49152:VYUwxqJIcFqgnhr+LJG5olrJbeh2OwcoLpVioKNsuuh11UxSlAUUZEFN:VY/xqJhsgnhrmGmlZehi3pVokTNlUZEj
Malware Config
Extracted
ginp
2.8d
mp43
http://sorryfordelay.top/
http://silverball.cc/
-
uri
api201
Extracted
ginp
http://sorryfordelay.top/api201/
http://silverball.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
soldier.unhappy.garageioc pid process /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 5017 soldier.unhappy.garage /data/user/0/soldier.unhappy.garage/app_DynamicOptDex/Tp.json 5017 soldier.unhappy.garage -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId soldier.unhappy.garage Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId soldier.unhappy.garage -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock soldier.unhappy.garage -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground soldier.unhappy.garage -
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
soldier.unhappy.garageioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction soldier.unhappy.garage -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
soldier.unhappy.garagedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo soldier.unhappy.garage
Processes
-
soldier.unhappy.garage1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD53be84dc3eea625b9f0debe41f642e1b0
SHA10590fd9d43ce7a9ac1afa257111fd799dbced9ef
SHA256351a0ff5546ba77d8bc784f29a4df8227cc254b872c47105a11eb3d5b43c90d9
SHA51252e4f4f048fca240502ef9b0488bd6c5c4b8c99e3d94a395d90fae736e774734c4f7457b9946111538ed5a3d3b1f34addd640199c26407bb7df4c73aca1cdf06
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/Tp.jsonFilesize
361KB
MD585c5d55c3a906bef6658d9613816d2b1
SHA12507b240dfcf7f5e16a85b6fa8ea99562f2a3d3c
SHA2568ad39fadaacb0a5a56e87222a534cd23282971ef094d1122dcd5dc1edf84d3f0
SHA512d7ef69c2d47cf4b9f50b119a448d9547e8514ab11180f9c14df9f563047b0f5041d5c0332574317f220876b480a3c2df3784a28d4ea6a6ac54b6c5bd1d82d2a6
-
/data/data/soldier.unhappy.garage/app_DynamicOptDex/oat/Tp.json.cur.profFilesize
332B
MD5abd1fbec16d7838a5d1c7859770f9bcc
SHA10f58d413e36388046f7774c1a9e90f7b05b11d67
SHA256b54314a6f03d783d3a9ecf69b684d943550d625f0c31a829545524c1aa3a745a
SHA512a1b5b9f9c67b10acfa08720847c0bfb06f30ae6497103b86792741d05bf95802d2fa768cbfd67bc473f9d750ceeccbfbbc8208d09e6ad3daadd05ea729408c4e