Researchers uncovered a new form of sophisticated Android banking malware named “Ginp” targets Android users via screen overlay attack to steal banking credentials, SMS & credit/debit card details to empty victims’ bank account.
The Ginp malware initially spotted at the end of the Oct 2019 since then the malware is continuously under development, and 5 different versions of the Trojan released within 5 months of the period.
Attackers mainly interested in Spanish based bank users, also they are continuously releasing regular updates, and some evidence found that the Gip malware copying code from infamous Anubis banking Trojan.
Ginp using multiple step overlay to avoid raising suspicion and the initial version was distributed via fake ” Google Play Verificator” app to steal the only incoming and outgoing SMS data.’
The next version has been released with a set of new features and spreading via masquerading as a fake “Adobe Flash Player” app to target some of the social and utility apps such as Google Play, Facebook, WhatsApp, Chrome, Skype, Instagram, and Twitter.
3 rd version of Ginp launched to focus on Banking sectors, and the attackers mainly target the 24 apps belongs to 7 different Spanish banks: Caixa bank, Bankinter, Bankia, BBVA, EVO Banco, Kutxabank and Santander.
Very recent version sophisticated than previous versions and the malware authors introduced an ability to grant the app the device admin permission and also added the new endpoint to download the additional module from C2 Server.
Ginp Malware Infection Process
Once the malware landed into the device, as a first step, it removes the icon and seeking the victim for the Accessibility Service privilege.
After permission granted, the Ginp itself grants some of the sensitive additional permission, such as send messages, and make calls, without requiring any further action from the victim.
Same as other banking trojans, Ginp Employed feature use of overlay attacks, SMS control, and contact list harvesting also uses the following set of features to fly under the radar and perform a successful attack.
- Overlaying: Dynamic (local overlays obtained from the C2)
- SMS harvesting: SMS listing
- SMS harvesting: SMS forwarding
- Contact list collection
- Application listing
- Overlaying: Targets list update
- SMS: Sending
- Calls: Call forwarding
- C2 Resilience: Auxiliary C2 list
- Self-protection: Hiding the App icon
- Self-protection: Preventing removal
- Self-protection: Emulation-detection
According to Threat Fabric research, “By abusing the accessibility service, Ginp determine which apps running in the background. Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details”
It targets various social media apps, such as Facebook, WhatsApp, Skype, Twitter, Chrome, Instagram, Snapchat and implements the generic credit card grabber overlay screen to harvest the card number, CVV, Date.
Researchers confirmed that the currently active version targeting a total of 24 unique apps. “In a 5-month timespan, the actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or RAT capabilities.” Researcher said.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
