Overview

overview

10

Static

static

6

d48543d061...04.apk

android-9-x86

10

d48543d061...04.apk

android-10-x64

1

d48543d061...04.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    188s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06-08-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d48543d061ac828a9270250ca89c5720bdd120166a1758269301b89117c60104.apk

  • Size

    3.0MB

  • MD5

    90eb34ca97d781dedb32692f324373ce

  • SHA1

    1b87d54121e1e0c483bc2940db02a8bffff3cc93

  • SHA256

    d48543d061ac828a9270250ca89c5720bdd120166a1758269301b89117c60104

  • SHA512

    ac684a7ea25f5b185f1a7cbd4188db5f46208a0edc96491e84ca251e5533b86da9654ae3f614296cb910e6409425d4d9e75ccea35e56fcff3d5455d64dba584c

  • SSDEEP

    98304:rgOq+gPwDhK1tTDvOfs6kACxYCSQdQuyn4f:UOq+oIKHvmkxxTSpn4f

Score
10/10
ginpmp68bankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp68

C2

http://crawlbone.top/

http://jackblack.cc/
Attributes
  • uri

    api201

Extracted

Family

ginp

C2

http://crawlbone.top/api201/

http://jackblack.cc/api201/

Signatures

  • Ginp

    Ginp is an android banking trojan first seen in mid 2019.

    bankertrojaninfostealerginp
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • aisle.spare.denial
    1⤵
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4222
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aisle.spare.denial/app_DynamicOptDex/srsIE.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aisle.spare.denial/app_DynamicOptDex/oat/x86/srsIE.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4247

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

3
T1633

System Checks

3
T1633.001

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/aisle.spare.denial/app_DynamicOptDex/oat/srsIE.json.cur.prof
    Filesize

    396B

    MD5

    f76c57d0b930c224635b2392e1b86290

    SHA1

    3ad54587f7693d4cdc0993aced777a6ec7192c54

    SHA256

    f347667dbda0db5c09c14ce5ae1a8658a9835098cc979ee868fa23f046a5d87c

    SHA512

    828cd81812de42fc10b19bf1a1a33e5f1015200501062c8baae7c0149f657af9165ec58caeabb9a8450055a59790c09a62dfa391e414101398ad697a36023de1

    Download Submit

  • /data/data/aisle.spare.denial/app_DynamicOptDex/srsIE.json
    Filesize

    466KB

    MD5

    749d8eae73ea2f8296dfd92e93c4021c

    SHA1

    38f4de726f1ba7799694af91d2ff6bf487c27316

    SHA256

    c82d36bdc9cf412e2b3d457f25384b3c37d0914d6eb89ca65fd4a8ce56a326b1

    SHA512

    c1c1d98f06346113bce4808f60d964b5ccac6c09bf37af62c6370fe4dce14e1ac63e50b6a429fb0fa2efb71fb06dfbcf0a4d68544b66e5ba4c546b559df074b6

    Download Submit

  • /data/data/aisle.spare.denial/app_DynamicOptDex/srsIE.json
    Filesize

    466KB

    MD5

    90d19233404c74dec8011facb24128bd

    SHA1

    0bf8e7433e4146931f92f92cba270ba524e2a8da

    SHA256

    15596d09bd83d066887e05213fdff850276e64932a8b696e2d2efb003f350002

    SHA512

    6895dd89e946bb2fbe106197d9441cfc1f60eae83b217eddf08308bea405b5f4f52aa0240ee102cff33a935e6117369f5c7dccf1f77e2b3a677ae91762df0a3d

    Download Submit

  • /data/user/0/aisle.spare.denial/app_DynamicOptDex/srsIE.json
    Filesize

    466KB

    MD5

    1817c3786a7889f9d6635f13c9194b7d

    SHA1

    626c2d014f650ba3b5bc5d3b5148b135ae06742f

    SHA256

    d0e21f896609029fb31eae351cf6dc4fbc20c6ee5588fbde00633ff09b0137d6

    SHA512

    19c024f98980dfb3a50ee8e372ee0ede1678213835d578217ca1c925f2694463ecfd68c2bb846cbdc2f3993c5ca9e468ab92651ae192044d6bf5092e77fd61a2

    Download Submit