ginp | a57722c7f7226f0aa9d0522201de4f90464ec0767312bd70d068c0874c5db086

Analysis

max time kernel
179s
max time network
187s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
05-08-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a57722c7f7226f0aa9d0522201de4f90464ec0767312bd70d068c0874c5db086.apk
Size

3.2MB
MD5

3a4ecfc9a36e7a4e95c5373a160ed226
SHA1

498a8f609fc55d8c84300fc019dd104b047989a4
SHA256

a57722c7f7226f0aa9d0522201de4f90464ec0767312bd70d068c0874c5db086
SHA512

9cb5e48cc1220652e3d2601bcdda1605b55679909b13c1bc57c8a1dc61dd774fde559aeaeecef95e5e5e685b79394fb3a43f184f7f38f88b66958a5420a57953
SSDEEP

49152:cZGm9XFAIv30HGRwE5DrVYVnIZ4BEdfh0Tgu4lP8W1Ge7V1JMl2tZbw90rFJ+7s:cdDhcYwcVYVHEdG/458W1Gelu0rjZ

Score

10^/10

ginp mp70 banker collection credential_access discovery evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp70

http://coldcoolcoco.top/

http://jackblack.cc/

Attributes

uri
api201

Extracted

Family

ginp

http://coldcoolcoco.top/api201/

http://jackblack.cc/api201/

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

Processes:

enter.shift.cruel

pid	Process
4249	enter.shift.cruel

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

enter.shift.cruel/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/enter.shift.cruel/app_DynamicOptDex/oat/x86/ew.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json	4249	enter.shift.cruel
/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/enter.shift.cruel/app_DynamicOptDex/oat/x86/ew.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json	4249	enter.shift.cruel

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	enter.shift.cruel
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	enter.shift.cruel
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	enter.shift.cruel

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	enter.shift.cruel

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	enter.shift.cruel

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

enter.shift.cruel

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	enter.shift.cruel

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	enter.shift.cruel

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	enter.shift.cruel

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

Processes:

enter.shift.cruel

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	enter.shift.cruel

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

enter.shift.cruel

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	enter.shift.cruel

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

enter.shift.cruel

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	enter.shift.cruel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

enter.shift.cruel

description	ioc	Process
File opened for read	/proc/cpuinfo	enter.shift.cruel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

enter.shift.cruel

description	ioc	Process
File opened for read	/proc/meminfo	enter.shift.cruel

enter.shift.cruel
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/enter.shift.cruel/app_DynamicOptDex/oat/x86/ew.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/enter.shift.cruel/app_DynamicOptDex/ew.json

Filesize
506KB

MD5
389574fe334344bdcae6ff46b19cb054

SHA1
513b987f781a1e3ba031a5a97eea53f164528f49

SHA256
4fb928dfc447f26dcf1a9918987f66062d63f5607f78def60154b0937e0d3564

SHA512
143022f1c52c5514ed8f57c52bf89e8a3d17c985214064ad3174584a16a4f58c1954f723097f0ae2a42a3db4855e1cda414d87c29e29b78436b0346e02d24d7b

Download Submit
/data/data/enter.shift.cruel/app_DynamicOptDex/ew.json

Filesize
506KB

MD5
357e51332c6fe1d2385251346d758ec9

SHA1
7fe3b1a726821ec50f44c401f2e31705f85a8b16

SHA256
94c7865b6386fba3c0e64be0e5873d1e2289981a16ff2cbeba5fc2fb49aa14b4

SHA512
ae7fc1169aedf0dfde58a2d371d2dac3880c76cd0519adc9b42276a5f8de82dd459aae62b04c6751f029ca55247a3f3ff7e4bd38f78af50f96bc9e3a3e5ae5a5

Download Submit
/data/data/enter.shift.cruel/app_DynamicOptDex/oat/ew.json.cur.prof

Filesize
373B

MD5
6eaae63776032898f22a98378406ffd8

SHA1
e1684437de2db243718c12b68d8dbf21d84c05b7

SHA256
02472bc75f1ca741b8a7332b92886b1f8dec5715b1154d636b475afe045af635

SHA512
3805a620f43e28ca3dc1cc5e7df4b0b2b4e891cda8d96395629925ff977dbace6241e9e47bf78ee0742d7ff8e37a410cff0d86d5a4149848a76a4149c4798658

Download Submit
/data/user/0/enter.shift.cruel/app_DynamicOptDex/ew.json

Filesize
506KB

MD5
f35529b22a779973dbb09093df620fb8

SHA1
67752c6e4e0e616532b26bd62a895c5040de9229

SHA256
2c5f75f79305aeefbb1703dc71a066c58420a5ecbda56aa4d9d07a5f7e242b7d

SHA512
63fbc8017a69a1bc8d212490a7d1cdaaa25c3958f1feccc8fd6a2d90d9f37240b493689ebaebb0e73264cdde898a34147fffa0757bf9c61b43bd52157a88b948

Download Submit