Malware

Ginp

Ginp is an Android banking trojan focused on credential and payment-card theft through phishing overlays and abuse of Android accessibility features. It has been observed masquerading as legitimate applications such as Adobe Flash Player and Google Play-related software to induce installation and permission grants. After installation, it can request Accessibility Service access, enumerate installed applications, monitor when targeted apps are opened, and launch WebView-based overlay pages to capture banking credentials and card data. Ginp has also used themed social-engineering lures, including a COVID-19-related “Coronavirus Finder” fraud, to trick victims into submitting payment information.

Beyond overlay-based credential theft, Ginp supports broad device-data collection and messaging abuse. Reported capabilities include collecting SMS messages, sending SMS messages, downloading the device contact list, obtaining installed application lists, and retrieving device logs. It can use fake notifications and inserted SMS messages to drive victims into targeted applications, and it has been reported to hide or suppress SMS activity by taking over default messaging functionality. Ginp also employs defense-evasion and persistence-related behaviors such as hiding its icon, redirecting users away from settings screens, and attempting to interfere with Google Play Protect.

Ginp is widely characterized as a banking trojan targeting Android devices, with activity observed in campaigns affecting users in Europe, including Spain and Greece. Code reuse from Anubis has been reported in some Ginp development. Its operational model centers on post-installation fraud enablement: harvesting credentials, intercepting or abusing SMS for account takeover and smishing, collecting device intelligence, and exfiltrating victim data to operator-controlled infrastructure.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence3

Fake device notifications A malicious application could send fake device notifications to the user. Clicking on the device notification could trigger the malicious application to display an input prompt.

Execution

1 technique

T1204.002Malicious FileEvidence1

to see such a web-page pop up on your device, you need to have Ginp on it first... Download apps only from Google Play (and disable the option to install apps from other sources).

Persistence

2 techniques

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

T1546.008Accessibility FeaturesEvidence2

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

Privilege Escalation

3 techniques

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

T1546.008Accessibility FeaturesEvidence2

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

T1548Abuse Elevation Control MechanismEvidence1

Do not give the Accessibility permission to apps that request it, other than anti-virus apps.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

we will see it is nop code and obfuscated code which makes the analysis of the code more harder and it’s an indicator that the sample is packed... the packer is JsonPacker

T1036MasqueradingEvidence2

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

T1564Hide ArtifactsEvidence1

After installing the malware, the malware will hide its icon and only the name of the malware MediaPlayer is visible. After enabling the Accessibility service, the malware will hide the icon and the name of the malware.

Credential Access

1 technique

T1056Input CaptureEvidence3

The web-page then offers you to input your card data to make the transaction... Ginp is a very capable banking Trojan that relies on a lot of different lures to make users input their credit card data into forms, so that it can steal it.

Collection

3 techniques

T1005Data from Local SystemEvidence4

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

T1056Input CaptureEvidence3

T1113Screen CaptureEvidence1

else if ( s6 . equals ( "TAKE_SCREENSHOT" )) { globalService0 . Tools . takeScreenshot ( globalService0 ); }

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

These are not all the commands which are recived by the malware from the C2 server... START_APP ... GET_APPS ... UNINSTALL_APP ... TAKE_SCREENSHOT ... GET_CONTACTS ... ALL_SMS

Other

1 technique

T1562Impair DefensesEvidence1

And disable Play protect, not to label it as malicious and it won’t delete the malware.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 years ago

hash.md5●●●●●●●●●●●●View more in app4 years ago

uri●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

muha2xmad blogNews

Sep 22, 2022

Technical analysis of Ginp android malware - muha2xmad

Android banking trojan that uses Accessibility abuse and overlay attacks to steal login and credit card credentials from targeted apps. It can collect installed apps, receive C2 commands, push fake notifications, generate fake SMS messages to lure victims into opening banking apps, steal stored SMS messages and contacts, send smishing SMS, hide incoming SMS by becoming the default messaging app, take screenshots, disable Play Protect, and maintain persistence by hiding its icon and interfering with user actions.

mitre attack websiteNews

Oct 21, 2021

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Android banking trojan that disguises itself as Adobe Flash Player or Google Play verification software.

mitre attack websiteNews

Oct 21, 2021

Input Prompt, Technique T1411 - Mobile | MITRE ATT&CK®

Android banking trojan that uses multi-step phishing overlays to steal banking credentials and payment card data.

mitre attack websiteNews

Oct 21, 2021

Application Discovery, Technique T1418 - Mobile | MITRE ATT&CK®

Android banking trojan that enumerates installed applications.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Ginp