ginp | 7ff64f6a0ebac8b2601ec169f0172e589a80f6f1347034f9fa368187f427b70c

General

Target
7ff64f6a0ebac8b2601ec169f0172e589a80f6f1347034f9fa368187f427b70c.apk
Size 3.5MB
Sample240809-15nn9swbqf
SHA256 7ff64f6a0ebac8b2601ec169f0172e589a80f6f1347034f9fa368187f427b70c
MD5 82a844bd0c82f91381b9d567adf014e5
SHA1 61be931e88b3ff5ac6b42216ad6a22c01b7105fd
SHA512 eb86ae1c8c25cae023d5a2296701514cabfa42f5cd1e1dc3d2e8aba31f06320e7a4ad33e8922bc82d0cc8b0f81ac459d88ca041ef46cfc7ff48f6ed50d3ed8fa
SSDEEP 98304:7hpBRKPfW06MTkpv9HlRCCdtwvO4pE17rDHzJdrSwxIYc4tUl:9pKTvTkN92ewv7YHzHrSwxTe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ginp mp76 banker collection credential_access discovery evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp76

C2

http://dirtysocks.top/
http://jackblack.cc/

Attributes

uri
api201

Extracted

Family

ginp

C2

http://dirtysocks.top/api201/
http://jackblack.cc/api201/

Signatures

Ginp
Ginp is an android banking trojan first seen in mid 2019.
banker trojan infostealer ginp

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5114	protect.onion.secret

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/protect.onion.secret/app_DynamicOptDex/ZtMCg.json	5114	protect.onion.secret
/data/user/0/protect.onion.secret/app_DynamicOptDex/ZtMCg.json	5114	protect.onion.secret

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	protect.onion.secret
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	protect.onion.secret
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	protect.onion.secret

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	protect.onion.secret

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	protect.onion.secret

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	protect.onion.secret

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	protect.onion.secret

protect.onion.secret
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
PID:5114

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

ZtMCg.json

Path /data/data/protect.onion.secret/app_DynamicOptDex/ZtMCg.json
Size 411KB
SHA256 fa9210897df1c1834d4b73bc62efe6c4eec95e40c9f16924e88f94c7dc2b9f41
MD5 21ec2891e060a8df450c4bcee4e5e6fd
SHA1 dd5a23796226b64fc000ebc10697c5eb1937849d
SHA512 b106ff0f4a47cca209284e4422037248af89f83ac448dc6d25415b3c321f3a04e5c6b6c7ae2ef75a753adb3295e5a50e17ab98673cae25ee192f34e7b57473cb
SSDEEP 6144:jX9Dh3fNXNahjpa52RCC4IWurIORtnvZE7E/1lIpXqS2jEc0HVrWUUYbQUxGs3uz:jXbNXYI52DpdlyA/d/jEH8JYb/l3xU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZtMCg.json

Path /data/data/protect.onion.secret/app_DynamicOptDex/ZtMCg.json
Size 411KB
SHA256 b96e5d791f937fcb634ee193230e0b950976a412ad07273c3cc6875ecf3873c3
MD5 03fdf953812d27f51729c20b88e0e657
SHA1 6b852d36552296a5843af0fd65e7d7256b15f5f7
SHA512 a5cedd0acbf1242a37570231a472d33d93cad727266e5747bfc8830a866761c84e60e5b33a1a9eed4e762f5f158121ee1b10e64c485dbf25c84574b9157fe53a
SSDEEP 6144:PEmXA08CAYApvSmCFha+NvjOErV9SUUqodxbn9R/7GbRje994PQ:JtvESmCFs+NvjOOWdF9Bp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZtMCg.json.cur.prof

Path /data/data/protect.onion.secret/app_DynamicOptDex/oat/ZtMCg.json.cur.prof
Size 400B
SHA256 a5069d83027807bc993bf2759cb2c007c3482aa4fecf89614698844a9cd02899
MD5 2246215d2cebe80798212e59a2061df8
SHA1 7b3385a0a2d405b5af353211f9ea51ba7e63b3e4
SHA512 f0d54500bb7b391750715152503fe8e3a427ebc44c944e6c1facf639a5fabca9dd949eb18afbfefc126a7726e91ce0b18322d76ad74720abfc8c397954fe273b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads