Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update


10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan .


Like previously added functionality , the code is borrowed from the leaked Anubis Trojan source code .


It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device .


Overlay attack Ginp uses the Accessibility Service to check which application runs is the foreground .


If the package name of the foreground app is included in the target list , an overlay is shown .


The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot .


Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps , first stealing the victim ’ s login credentials , then stealing the credit card details ( to “ validate ” the user identity ) , as shown in the screenshots hereafter : The following code snippet shows that after the second overlay is filled-in and validated , it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks .


Targets The initial version of Ginp had a generic credit card grabber overlay screen used for all targeted applications .


Still included in the last versions , this screen is only used to overlay the official Google Play Store app .


More apps could be added to the grabber target list in the future , such as the ones that were targeted in older versions : Facebook WhatsApp Skype Twitter Chrome Instagram Snapchat Viber The following screenshot shows the generic card grabber overlay screen : Ginp generic grabber The current active target list is available in the appendix , containing a total of 24 unique targets .


The following screenshots show what type of information is collected in both steps of the overlay attack : Ginp overlaysGinp overlaysGinp overlaysGinp overlays Based on Anubis Once the Anubis bot code got leaked , it was just a matter of time before new banking Trojans based on Anubis would surface .


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan .


Based on the evolution of Ginp it is clear that it isn ’ t based on Anubis , but rather reuses some of its code .


Below are some of the elements showing the relation .


The names used for Android components are similar : Similarities with AnubisSimilarities with Anubis When analyzing these components , similarities were found in the code of both malware families : Similarities with Anubis Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values .


Previous versions were storing config values within the variables of a class , while the latest version is using SharedPreferences with some of the keys being identical to those used by Anubis : isAccessibility time_work time_start_permission url_inj Conclusion Ginp is a simple but rather efficient banking Trojan providing the basic functionality to be able to trick victims into delivering personal information .


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities .


Ginp ’ s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution .


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions .


Appendix Samples Some of the latest Ginp samples found in the wild : App name Package name SHA-256 hash Google Play Verificator sing.guide.false 0ee075219a2dfde018f17561467272633821d19420c08cba14322cc3b93bb5d5 Google Play Verificator park.rather.dance 087a3beea46f3d45649b7506073ef51c784036629ca78601a4593759b253d1b7 Adobe Flash Player ethics.unknown.during


5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c


Adobe Flash Player sentence.fancy.humble 78557094dbabecdc17fb0edb4e3a94bae184e97b1b92801e4f8eb0f0626d6212 Target list The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below .


This list is expected to grow in the future .