Ginp Trojan Targets Android Banking App Users, Steals Login Credentials and Credit Card Details
Counterfeit apps were found carrying a new version of the Android banking trojan called Ginp (detected by Trend Micro as AndroidOS_Ginp.HRXB) to steal user login credentials and credit card details. ThreatFabric’s analysis of recent Ginp samples showed that it reused some code from Anubis, an Android malware family notorious for its use in cyberespionage activities before being retooled as a banking trojan.
Ginp’s trojan functions
Upon execution in a victim device, Ginp removes its icon from the app drawer before asking the user for Accessibility Service privilege. Once it receives the said privilege, it grants itself additional permissions for sending messages and making calls.
Ginp is capable of sending or harvesting SMS messages based on received commands. It can also request admin privileges, enable overlay attacks, update the command-and-control (C&C) URL, update the target list, set itself as the default SMS app, prevent the user from disabling Accessibility Services, get installed apps or contacts, enable call forwarding, and hide itself and prevent removal, among other capabilities.
Notably, Ginp can trick the victim into giving out login credentials and credit card details by claiming that these pieces of information are a prerequisite to validate user identity.
Ginp’s five-month evolution
In its first iteration, Ginp disguised itself as a "Google Play Verificator" app, primarily stealing SMS messages. In August, it posed as fake “Adobe Flash Player” apps targeting credit card information. The next version was enhanced with payload obfuscation and started targeting Snapchat and Viber users as well as specific banking apps.
After that, the Ginp author borrowed code from the Anubis malware, whose source code was leaked earlier this year. The said version notably switched to a new overlay target list and predominantly went after banking app users. Trend Micro mobile threat analyst Tony Bao discovered a variant of Anubis (detected by Trend Micro as AndroidOS_AnubisDropper) of the same type a few months ago. The Anubis variant analyzed in Bao’s research targeted 188 banking- and finance-related apps.
In its latest form, Ginp was found with slight modifications, including a new endpoint related to downloading a module and pieces of code borrowed from Anubis. This Ginp iteration targets users of 24 apps from different Spanish banks.
Security recommendations
Ginp’s use of deceptive overlay screens to steal login credentials and credit card details should prompt users to be more vigilant when installing apps on their devices. They should only download apps from official sources to minimize the chances of downloading a malicious app.
Users and enterprises can also take advantage of multilayered mobile security such as the Trend Micro™ Mobile Security for Android™ solution. Trend Micro Mobile Security for Enterprise provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps, and detects and blocks malware and fraudulent websites. Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies, protecting devices against malware, zero-day and known exploits, privacy leaks, and application vulnerabilities.Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
Cellular IoT Vulnerabilities: Another Door to Cellular Networks
Today’s Cloud and Container Misconfigurations Are Tomorrow’s Critical Vulnerabilities
The Artificial Future: Trend Micro Security Predictions for 2025
The Realities of Quantum Machine Learning