Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24/02/2025, 22:11
General
-
Target
345dac4d6126256711afea0b2c338bd68cbd8725dd9cbc8977399725c19b8f91.apk
-
Size
3.3MB
-
MD5
c20e7e9d59bc7943d2e787a55401c7ed
-
SHA1
967ab60285ef2d9c747b2c1692b4e6f747d5aeb0
-
SHA256
345dac4d6126256711afea0b2c338bd68cbd8725dd9cbc8977399725c19b8f91
-
SHA512
bb23655871460b9b0d83e2d3e758b565db3c9114538f973854149de79bfeb456471603b38879c3de7a79adb153f59ae0fca0e39e0453fa5539474783cde6e608
-
SSDEEP
49152:KPZWhE9XFAIibc1nRjfiZsXMtA8dkwD7XmmzF0NYA0ol4TSEfCV3Jv6Q2GeaREPJ:85DhionRTIsXMtA8fXmrKyWXfCV3TPaJ
Malware Config
Extracted
ginp
2.8d
mp67
http://sunshinecat.top/
http://jackblack.cc/
-
uri
api201
Extracted
ginp
http://sunshinecat.top/api201/
Signatures
-
Ginp
Ginp is an android banking trojan first seen in mid 2019.
-
Ginp family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
issue.claim.oak1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
491KB
MD5c41a76e9fa17acebe8b3f4aaef9356d7
SHA15887f20aa7534876f5357a5138795c27ee607550
SHA256f8338b90eea68c16b7a30eafc7113dfb195285466f8c39ec633fa7c779062a41
SHA512f6a89c199744400da35b0f88ccf24ef46ad3f3632ba31a165ff7e6081436380280b1040171fc94fbe7afec75e58ff96f023f6fec1595de99c1724cfaa9459fd3
-
Filesize
491KB
MD5c0e2cf0f7dc7050dfdf775df15a44ccd
SHA1a14d492884e365fc57019911ea9848cb7cd32b84
SHA2564a3e0db677bfd0f7d47d90682e11c43d1cc8bf64124956205ff45f0aca2b5de4
SHA512d6a04480c14e1a77b7c78c0c1e01cb1d17bb346d65698c677cd309e90dfab8e5a451990696d43a7cde0de758b7da479fb42830894f8f274209dab75fb4dd1160