Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-08-2024 22:03
General
-
Target
059552b24ba96f140fec438dbe651d66c9341232e3f56aba962b67e80e04561e.apk
-
Size
3.2MB
-
MD5
88097ea445b1072b327173d3b6803709
-
SHA1
ded9be6a67fe77a40f52bd31a5249fea09785743
-
SHA256
059552b24ba96f140fec438dbe651d66c9341232e3f56aba962b67e80e04561e
-
SHA512
5bcce543c408bcc5ca54249e8f6f3aa9d9f6d093ec5b4b0f9f9e62a28f3676b6cfd1b9c5ec3f34f0c6127434507e057c6c379e99195ee4e1927e6d31df813c73
-
SSDEEP
98304:PqDhuHRbzxXJS3KLqR9APIm0pp6VYUdWAvo47zYzN4w:PGuHR/xXsaLqMQ2dQOkx4w
Malware Config
Extracted
ginp
2.8d
mp70
http://coldcoolcoco.top/
http://jackblack.cc/
-
uri
api201
Extracted
ginp
http://coldcoolcoco.top/api201/
http://jackblack.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
donkey.infant.lawsuit1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
485KB
MD5f8cd81c01e2a4de9414fb687e63a19fb
SHA1fff45d63adc55e4c367fae2568155fc50c3e8f3f
SHA2561b70678ffb46e048b52d955841becd838e6b8750d768a6d42dc81866f83a8586
SHA5126c54791e8d7f04d6ab9776d8d8f38a550dbdf1f2e4e0f1998bb12eefd4eeb33299d52b3221e015bcf0c20aca39911413c108520c0be82349e2c6f16922c01f30
-
Filesize
485KB
MD553543796019016b0a01182808d4d5421
SHA102176ca66d30ccdc06ef106d4b9bfef21dd937c9
SHA256a79928caa651a9f12415ca396ae02eb9ed38a928b7324058259bef5e6c6c5f9b
SHA512dba8b9489d77478635a7a0185233de4d7f8837e0dadcb2f80aefc01453602844ce0427378c1c524fdfb5c0e252b6aa8dd7bb7cd4dfefdb09b59ea033ae4b73d4