Overview

overview

10

Static

static

6

4bd4c8dcd3...3d.apk

android-9-x86

10

4bd4c8dcd3...3d.apk

android-10-x64

10

4bd4c8dcd3...3d.apk

android-11-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05-08-2024 07:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bd4c8dcd3e42e5980e7f9d7adb9c33d.apk

  • Size

    2.9MB

  • MD5

    4bd4c8dcd3e42e5980e7f9d7adb9c33d

  • SHA1

    8b8365830acff08df8ecf52676b884acafe42994

  • SHA256

    5bc0916cf51f6deb1592f8e01e55433689f7049ec3016ab72c2f6e1775c57c30

  • SHA512

    dc6542651816b3847ace57895c1194b85c41cc7b34eeafa35ee7fa7bca31a29cd64a659d83aeeb88bd59e75111ae49152e89baf81d0c3e061fd55c0bd24d8ade

  • SSDEEP

    49152:b/7FtLgEDYBNeyPqrxVHLio41fZwXHLs+M7PHxuSHc7YFXvOvnvjfZ9S0:D7wsaNJqfriP7A7MzHgSH+YBvOvvjD

Score
10/10
ginpmp13bankerdiscoveryevasioninfostealertrojan

Malware Config

Extracted

Family

ginp

Version

2.8e

Botnet

mp13

C2

http://wholepartyhere.top/

http://insideluck.cc/
Attributes
  • uri

    api202

Signatures

  • Ginp

    Ginp is an android banking trojan first seen in mid 2019.

    bankertrojaninfostealerginp
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery

Processes

  • com.learn.habit
    1⤵
    • Loads dropped Dex/Jar
    PID:4254
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.learn.habit/app_DynamicOptDex/FyC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.learn.habit/app_DynamicOptDex/oat/x86/FyC.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4279

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.learn.habit/app_DynamicOptDex/FyC.json
    Filesize

    249KB

    MD5

    8af4989ef5a56d70ef425aa86af8725f

    SHA1

    c6322d3835a58308bd9103e38000d11eec69358b

    SHA256

    8b8e29450c71540c4b4a2f4a1c696a5c5f556fddd4430973dcde50ad835d6c7e

    SHA512

    945605f757a4bd8a4a10cb763c2dd5d2885b196e99e9999a2f5d044e4ab06f40f19616328657f886374dd53659c3ec7a9609d0dfab27052c6162def981112b81

    Download Submit

  • /data/data/com.learn.habit/app_DynamicOptDex/FyC.json
    Filesize

    249KB

    MD5

    2b46cba304019f2ee51f154202c2501f

    SHA1

    14700dfddb0457f6034f9b908474751f305d68df

    SHA256

    6e5ca745b4abf260d3e77ff8d9ed0fa983787538fa3d4fbbf6c73680aa193692

    SHA512

    cf681dc74ca7b21cb47bc4265933e9e5a181578846692c689f7c0a4c9c8f73af44daeb90770d73fd4da37e6f3b336189ff82e59c08515209b8fb1f88130d77c8

    Download Submit

  • /data/user/0/com.learn.habit/app_DynamicOptDex/FyC.json
    Filesize

    249KB

    MD5

    72b8b8f31603e5d76c9e24b45bf44117

    SHA1

    20a05da01af04a369f5f0fc883ffa30cf379b1f1

    SHA256

    5266fa7f3ff64d1923228717d2393e1ad952dc49dd203353ab25d5d304bc69d1

    SHA512

    6ab30dacb83205b3a9e7dda33ec82876d08e21f977f7cf8f9f10ae89ef363448630d3e72f39c251f772bf0c00a3de31cd210a2ed9fdff1a5eb16438d30c98cb2

    Download Submit