ginp | 5bc0916cf51f6deb1592f8e01e55433689f7049ec3016ab72c2f6e1775c57c30

Analysis

max time kernel
2s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05/08/2024, 07:22 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bd4c8dcd3e42e5980e7f9d7adb9c33d.apk
Size

2.9MB
MD5

4bd4c8dcd3e42e5980e7f9d7adb9c33d
SHA1

8b8365830acff08df8ecf52676b884acafe42994
SHA256

5bc0916cf51f6deb1592f8e01e55433689f7049ec3016ab72c2f6e1775c57c30
SHA512

dc6542651816b3847ace57895c1194b85c41cc7b34eeafa35ee7fa7bca31a29cd64a659d83aeeb88bd59e75111ae49152e89baf81d0c3e061fd55c0bd24d8ade
SSDEEP

49152:b/7FtLgEDYBNeyPqrxVHLio41fZwXHLs+M7PHxuSHc7YFXvOvnvjfZ9S0:D7wsaNJqfriP7A7MzHgSH+YBvOvvjD

Score

10^/10

ginp mp13 banker discovery evasion infostealer trojan

Malware Config

Extracted

Family

ginp

Version

2.8e

Botnet

mp13

http://wholepartyhere.top/

http://insideluck.cc/

Attributes

uri
api202

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.learn.habit/app_DynamicOptDex/FyC.json	4997	com.learn.habit
/data/user/0/com.learn.habit/app_DynamicOptDex/FyC.json	4997	com.learn.habit

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.learn.habit
1⤵
- Loads dropped Dex/Jar
PID:4997

Network

DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A

Response

ssl.google-analytics.com

IN A

172.217.169.40
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

216.58.212.238

172.217.169.40:443

ssl.google-analytics.com

tls

1.3kB
5.9kB
8
9
142.250.179.238:443

tls, https

857 B
40 B
1
1
216.58.212.238:443

android.apis.google.com

tls

5.9kB
9.4kB
20
25
142.250.180.4:443

tls, https

454 B
40 B
2
1
142.250.180.4:443

www.google.com

tls

8.4kB
11.2kB
26
37
216.58.201.98:443

520 B
10
172.217.169.46:443

520 B
10

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

ssl.google-analytics.com

dns

70 B
86 B
1
1

DNS Request

ssl.google-analytics.com

DNS Response

172.217.169.40
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

216.58.212.238

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.learn.habit/app_DynamicOptDex/FyC.json

Filesize
249KB

MD5
8af4989ef5a56d70ef425aa86af8725f

SHA1
c6322d3835a58308bd9103e38000d11eec69358b

SHA256
8b8e29450c71540c4b4a2f4a1c696a5c5f556fddd4430973dcde50ad835d6c7e

SHA512
945605f757a4bd8a4a10cb763c2dd5d2885b196e99e9999a2f5d044e4ab06f40f19616328657f886374dd53659c3ec7a9609d0dfab27052c6162def981112b81

Download Submit
/data/data/com.learn.habit/app_DynamicOptDex/FyC.json

Filesize
249KB

MD5
2b46cba304019f2ee51f154202c2501f

SHA1
14700dfddb0457f6034f9b908474751f305d68df

SHA256
6e5ca745b4abf260d3e77ff8d9ed0fa983787538fa3d4fbbf6c73680aa193692

SHA512
cf681dc74ca7b21cb47bc4265933e9e5a181578846692c689f7c0a4c9c8f73af44daeb90770d73fd4da37e6f3b336189ff82e59c08515209b8fb1f88130d77c8

Download Submit