Overview

overview

10

Static

static

6

3c6b89f4c0...90.apk

android-9-x86

10

3c6b89f4c0...90.apk

android-10-x64

10

3c6b89f4c0...90.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    19-01-2025 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c6b89f4c0ad90f79a5fcf1f22a0f095422a2eda8c69723f5f1fc8a5c2fb1b90.apk

  • Size

    3.1MB

  • MD5

    3eb9ede0fe2a49c127554e1c45c3163f

  • SHA1

    0fef9d3823ecfdad44c4b46daf0818c2c548e382

  • SHA256

    3c6b89f4c0ad90f79a5fcf1f22a0f095422a2eda8c69723f5f1fc8a5c2fb1b90

  • SHA512

    430e5118c896af52e952f54642b34178a9546c0c8e03e3bfe23280f00cfce6b0b136287f05b747bcb2ac03b2333f0b7ab41635ed3aca7ccf861f41d9562a6367

  • SSDEEP

    98304:b48aqzkGAiwyWdvKXxeHaQhhCZ44dUyP29Xsgc:b48eGAiwVdIxKCTdU029w

Score
10/10
ginpmp66bankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp66

C2

http://sitandread.top/

http://jackblack.cc/
Attributes
  • uri

    api201

Extracted

Family

ginp

C2

http://sitandread.top/api201/

http://jackblack.cc/api201/

Signatures

  • Ginp

    Ginp is an android banking trojan first seen in mid 2019.

    bankertrojaninfostealerginp
  • Ginp family
    ginp
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • amazing.shrug.market
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4211
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/amazing.shrug.market/app_DynamicOptDex/wymRkl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/amazing.shrug.market/app_DynamicOptDex/oat/x86/wymRkl.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4237

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/amazing.shrug.market/app_DynamicOptDex/oat/wymRkl.json.cur.prof
    Filesize

    335B

    MD5

    093f4229e14c3b75bb2599a51ff689aa

    SHA1

    6dbfaa14b9c5e3a9706e411af7bde95a55bdb830

    SHA256

    b3d1a2d0b9e9d93aa10e1f845c15cd600ceaa88e0d98d9aa813e6efd80ad0c51

    SHA512

    b56e1c1def4de6e34d2e8a0046466c96f364b9f58c168d325a5316d9e8470746e6e211e402683059266819b76c67c105f4d6d50cc88e546d93ca14449b74e1eb

    Download Submit

  • /data/data/amazing.shrug.market/app_DynamicOptDex/wymRkl.json
    Filesize

    433KB

    MD5

    e8ba1bc10ddf61e4dc5dce414ed5d114

    SHA1

    5d086d47a0b8119dc5b04233f7c15c32a0cf8501

    SHA256

    5e3c5572c6fd7c77340209dd3a54342110e35cac4a4005c1b92d27e9486f9889

    SHA512

    d0eaeb8d50290afb73bea792309298097e2afa35d289c2052e67ef9e8283b06f115ace30d6ca6099814b64affe00e76db1bd1b5d6067ffae6fd9ae71fb61981f

    Download Submit

  • /data/data/amazing.shrug.market/app_DynamicOptDex/wymRkl.json
    Filesize

    433KB

    MD5

    279a948d13079d36458acead75105832

    SHA1

    d6431a1b90eabf65d82184eb81c9f04da1e9940f

    SHA256

    d89dd11a2886b25d0d443fe4025b597e5800468ebe40f08c36c7c5632ec12078

    SHA512

    c97b934a861ff64c94b0d04096945e2e73eca1ec2161991ac9aa057f0d5fb55ba165ee839e42e79a5e19732f55ac490edf6bd6f1471f4333beefce8b5e3a83a2

    Download Submit

  • /data/user/0/amazing.shrug.market/app_DynamicOptDex/wymRkl.json
    Filesize

    433KB

    MD5

    e816a9542242515f31c1e8b2d60f2e08

    SHA1

    6d2cce2f230c31139c05b3350012072d7de5403d

    SHA256

    92199f2853ec4759302d87e9395ffaebbbf534dc111251626507bc5c20f737ac

    SHA512

    61c3e5da26af1181e3a2be570a14d9f7d02fe232b811c25daf9c268cee7016425d2ca9fd7db86afd5e8f63962042da6568c149d413f952e9aeb1a12ab86e6acb

    Download Submit