Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-01-2025 22:04
General
-
Target
3c6b89f4c0ad90f79a5fcf1f22a0f095422a2eda8c69723f5f1fc8a5c2fb1b90.apk
-
Size
3.1MB
-
MD5
3eb9ede0fe2a49c127554e1c45c3163f
-
SHA1
0fef9d3823ecfdad44c4b46daf0818c2c548e382
-
SHA256
3c6b89f4c0ad90f79a5fcf1f22a0f095422a2eda8c69723f5f1fc8a5c2fb1b90
-
SHA512
430e5118c896af52e952f54642b34178a9546c0c8e03e3bfe23280f00cfce6b0b136287f05b747bcb2ac03b2333f0b7ab41635ed3aca7ccf861f41d9562a6367
-
SSDEEP
98304:b48aqzkGAiwyWdvKXxeHaQhhCZ44dUyP29Xsgc:b48eGAiwVdIxKCTdU029w
Malware Config
Extracted
ginp
2.8d
mp66
http://sitandread.top/
http://jackblack.cc/
-
uri
api201
Extracted
ginp
http://sitandread.top/api201/
http://jackblack.cc/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Ginp family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
amazing.shrug.market1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD5e8ba1bc10ddf61e4dc5dce414ed5d114
SHA15d086d47a0b8119dc5b04233f7c15c32a0cf8501
SHA2565e3c5572c6fd7c77340209dd3a54342110e35cac4a4005c1b92d27e9486f9889
SHA512d0eaeb8d50290afb73bea792309298097e2afa35d289c2052e67ef9e8283b06f115ace30d6ca6099814b64affe00e76db1bd1b5d6067ffae6fd9ae71fb61981f
-
Filesize
433KB
MD5279a948d13079d36458acead75105832
SHA1d6431a1b90eabf65d82184eb81c9f04da1e9940f
SHA256d89dd11a2886b25d0d443fe4025b597e5800468ebe40f08c36c7c5632ec12078
SHA512c97b934a861ff64c94b0d04096945e2e73eca1ec2161991ac9aa057f0d5fb55ba165ee839e42e79a5e19732f55ac490edf6bd6f1471f4333beefce8b5e3a83a2