General

  • Target

    4bd4c8dcd3e42e5980e7f9d7adb9c33d.apk

  • Size

    2.9MB

  • Sample

    240805-h7fsbszdjk

  • MD5

    4bd4c8dcd3e42e5980e7f9d7adb9c33d

  • SHA1

    8b8365830acff08df8ecf52676b884acafe42994

  • SHA256

    5bc0916cf51f6deb1592f8e01e55433689f7049ec3016ab72c2f6e1775c57c30

  • SHA512

    dc6542651816b3847ace57895c1194b85c41cc7b34eeafa35ee7fa7bca31a29cd64a659d83aeeb88bd59e75111ae49152e89baf81d0c3e061fd55c0bd24d8ade

  • SSDEEP

    49152:b/7FtLgEDYBNeyPqrxVHLio41fZwXHLs+M7PHxuSHc7YFXvOvnvjfZ9S0:D7wsaNJqfriP7A7MzHgSH+YBvOvvjD

Malware Config

Extracted

Family

ginp

Version

2.8e

Botnet

mp13

C2

http://wholepartyhere.top/

http://insideluck.cc/

Attributes
  • uri

    api202

Targets

    • Target

      4bd4c8dcd3e42e5980e7f9d7adb9c33d.apk

    • Size

      2.9MB

    • MD5

      4bd4c8dcd3e42e5980e7f9d7adb9c33d

    • SHA1

      8b8365830acff08df8ecf52676b884acafe42994

    • SHA256

      5bc0916cf51f6deb1592f8e01e55433689f7049ec3016ab72c2f6e1775c57c30

    • SHA512

      dc6542651816b3847ace57895c1194b85c41cc7b34eeafa35ee7fa7bca31a29cd64a659d83aeeb88bd59e75111ae49152e89baf81d0c3e061fd55c0bd24d8ade

    • SSDEEP

      49152:b/7FtLgEDYBNeyPqrxVHLio41fZwXHLs+M7PHxuSHc7YFXvOvnvjfZ9S0:D7wsaNJqfriP7A7MzHgSH+YBvOvvjD

    • Ginp

      Ginp is an android banking trojan first seen in mid 2019.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

MITRE ATT&CK Mobile v15

Tasks