Overview

overview

10

Static

static

6

345dac4d61...91.apk

android-9-x86

10

345dac4d61...91.apk

android-10-x64

10

345dac4d61...91.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    24/02/2025, 22:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    345dac4d6126256711afea0b2c338bd68cbd8725dd9cbc8977399725c19b8f91.apk

  • Size

    3.3MB

  • MD5

    c20e7e9d59bc7943d2e787a55401c7ed

  • SHA1

    967ab60285ef2d9c747b2c1692b4e6f747d5aeb0

  • SHA256

    345dac4d6126256711afea0b2c338bd68cbd8725dd9cbc8977399725c19b8f91

  • SHA512

    bb23655871460b9b0d83e2d3e758b565db3c9114538f973854149de79bfeb456471603b38879c3de7a79adb153f59ae0fca0e39e0453fa5539474783cde6e608

  • SSDEEP

    49152:KPZWhE9XFAIibc1nRjfiZsXMtA8dkwD7XmmzF0NYA0ol4TSEfCV3Jv6Q2GeaREPJ:85DhionRTIsXMtA8fXmrKyWXfCV3TPaJ

Score
10/10
ginpmp67bankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ginp

Version

2.8d

Botnet

mp67

C2

http://sunshinecat.top/

http://jackblack.cc/
Attributes
  • uri

    api201

Extracted

Family

ginp

C2

http://sunshinecat.top/api201/

Signatures

  • Ginp

    Ginp is an android banking trojan first seen in mid 2019.

    bankertrojaninfostealerginp
  • Ginp family
    ginp
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • issue.claim.oak
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4210
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/issue.claim.oak/app_DynamicOptDex/wcYDfgS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/issue.claim.oak/app_DynamicOptDex/oat/x86/wcYDfgS.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4239

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/issue.claim.oak/app_DynamicOptDex/oat/wcYDfgS.json.cur.prof
    Filesize

    407B

    MD5

    fb0235ceffa4d485aa7547d5ffdf4195

    SHA1

    e727809d5121a3169378d625018c09123028bfec

    SHA256

    c6cb7ed6dba0238e53cd61b6ab346d7cc17102b235a3f705e7c27429a3ff71ae

    SHA512

    839b59ea8319e1a6196ae3479b1bd1829fc83d2b1a0ba46ea8a9a61f5bbcf83fedf7c8b8abbd7b673ae8120637c3cda5c3d2909c5218ccc2d858f365f275b001

    Download Submit

  • /data/data/issue.claim.oak/app_DynamicOptDex/wcYDfgS.json
    Filesize

    491KB

    MD5

    c41a76e9fa17acebe8b3f4aaef9356d7

    SHA1

    5887f20aa7534876f5357a5138795c27ee607550

    SHA256

    f8338b90eea68c16b7a30eafc7113dfb195285466f8c39ec633fa7c779062a41

    SHA512

    f6a89c199744400da35b0f88ccf24ef46ad3f3632ba31a165ff7e6081436380280b1040171fc94fbe7afec75e58ff96f023f6fec1595de99c1724cfaa9459fd3

    Download Submit

  • /data/data/issue.claim.oak/app_DynamicOptDex/wcYDfgS.json
    Filesize

    491KB

    MD5

    c0e2cf0f7dc7050dfdf775df15a44ccd

    SHA1

    a14d492884e365fc57019911ea9848cb7cd32b84

    SHA256

    4a3e0db677bfd0f7d47d90682e11c43d1cc8bf64124956205ff45f0aca2b5de4

    SHA512

    d6a04480c14e1a77b7c78c0c1e01cb1d17bb346d65698c677cd309e90dfab8e5a451990696d43a7cde0de758b7da479fb42830894f8f274209dab75fb4dd1160

    Download Submit

  • /data/user/0/issue.claim.oak/app_DynamicOptDex/wcYDfgS.json
    Filesize

    491KB

    MD5

    f565984b3d894fe4228361cd4c3d2ec6

    SHA1

    d440088712ec10e3ef32b83b0f688a3dc600679c

    SHA256

    4779a199a2314eba23fa7e805829597a551bfa5d9241e82252dd292762b4ddb8

    SHA512

    756ac210dd92a58fa1233a6f67d1e4ee8ddf484e7875790ffdc2ab414fbb19c83786779d732fe0f9bd583099a009a1ea14755e1d7488844361c64b78fc14c1ab

    Download Submit