Friday, March 29, 2024

Android Banking Malware “Ginp” Steal Credit/Debit Card Info via Screen Overlay Attack To Empty Your Bank Money

Researchers uncovered a new form of sophisticated Android banking malware named “Ginp” targets Android users via screen overlay attack to steal banking credentials, SMS & credit/debit card details to empty victims’ bank account.

The Ginp malware initially spotted at the end of the Oct 2019 since then the malware is continuously under development, and 5 different versions of the Trojan released within 5 months of the period.

Attackers mainly interested in Spanish based bank users, also they are continuously releasing regular updates, and some evidence found that the Gip malware copying code from infamous Anubis banking Trojan

Ginp using multiple step overlay to avoid raising suspicion and the initial version was distributed via fake ” Google Play Verificator” app to steal the only incoming and outgoing SMS data.’

The next version has been released with a set of new features and spreading via masquerading as a fake “Adobe Flash Player” app to target some of the social and utility apps such as Google Play, Facebook, WhatsApp, Chrome, Skype, Instagram, and Twitter.

3 rd version of Ginp launched to focus on Banking sectors, and the attackers mainly target the 24 apps belongs to 7 different Spanish banks: Caixa bank, Bankinter, Bankia, BBVA, EVO Banco, Kutxabank and Santander.

Very recent version sophisticated than previous versions and the malware authors introduced an ability to grant the app the device admin permission and also added the new endpoint to download the additional module from C2 Server.

Ginp Malware Infection Process

Once the malware landed into the device, as a first step, it removes the icon and seeking the victim for the Accessibility Service privilege.

After permission granted, the Ginp itself grants some of the sensitive additional permission, such as send messages, and make calls, without requiring any further action from the victim.

Same as other banking trojans, Ginp Employed feature use of overlay attacks, SMS control, and contact list harvesting also uses the following set of features to fly under the radar and perform a successful attack.

  • Overlaying: Dynamic (local overlays obtained from the C2)
  • SMS harvesting: SMS listing
  • SMS harvesting: SMS forwarding
  • Contact list collection
  • Application listing
  • Overlaying: Targets list update
  • SMS: Sending
  • Calls: Call forwarding
  • C2 Resilience: Auxiliary C2 list
  • Self-protection: Hiding the App icon
  • Self-protection: Preventing removal
  • Self-protection: Emulation-detection

According to Threat Fabric research, “By abusing the accessibility service, Ginp determine which apps running in the background. Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details”

It targets various social media apps, such as Facebook, WhatsApp, Skype, Twitter, Chrome, Instagram, Snapchat and implements the generic credit card grabber overlay screen to harvest the card number, CVV, Date.

Researchers confirmed that the currently active version targeting a total of 24 unique apps. “In a 5-month timespan, the actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or RAT capabilities.” Researcher said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles