Ginp  - GINP - Banking Malware “Ginp” Steal Card Info via Screen Overlay Attack

Researchers uncovered a new form of sophisticated banking malware named “Ginp” targets users via screen overlay attack to steal banking credentials, SMS & credit/debit card details to empty victims’ bank account.

The Ginp malware initially spotted at the end of the Oct since then the malware is continuously under development, and 5 different versions of the Trojan released within 5 months of the period.

Attackers mainly interested in Spanish based bank users, also they are continuously releasing regular updates, and some evidence found that the Gip malware copying code from infamous Anubis banking Trojan

Ginp using multiple step overlay to avoid raising suspicion and the initial version was distributed via fake ” Play Verificator” app to steal the only incoming and outgoing SMS data.’

The next version has been released with a set of new features and spreading via masquerading as a fake “Adobe Flash Player” app to target some of the social and utility apps such as Google Play, Facebook, WhatsApp, Chrome, Skype, Instagram, and Twitter.

3 rd version of Ginp launched to focus on Banking sectors, and the attackers mainly target the 24 apps belongs to 7 different Spanish banks: Caixa bank, Bankinter, Bankia, BBVA, EVO Banco, Kutxabank and Santander.

Very recent version sophisticated than previous versions and the malware authors introduced an ability to grant the app the device admin permission and also added the new endpoint to download the additional module from C2 Server.

Ginp Malware Infection Process

Once the malware landed into the device, as a first step, it removes the icon and seeking the victim for the Accessibility Service privilege.

After permission granted, the Ginp itself grants some of the sensitive additional permission, such as send messages, and make calls, without requiring any further action from the victim.

- accesibility - Banking Malware “Ginp” Steal Card Info via Screen Overlay Attack

Same as other banking trojans, Ginp Employed feature use of overlay attacks, SMS control, and contact list harvesting also uses the following set of features to fly under the radar and perform a successful attack.

  • Overlaying: Dynamic (local overlays obtained from the C2)
  • SMS harvesting: SMS listing
  • SMS harvesting: SMS forwarding
  • Contact list collection
  • listing
  • Overlaying: Targets list update
  • SMS: Sending
  • Calls: Call forwarding
  • C2 Resilience: Auxiliary C2 list
  • Self-protection: Hiding the App icon
  • Self-protection: Preventing removal
  • Self-protection: Emulation-detection

According to Threat Fabric research, “By abusing the accessibility service, Ginp determine which apps running in the background. Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details”

It targets various social media apps, such as Facebook, WhatsApp, Skype, Twitter, Chrome, Instagram, Snapchat and implements the generic credit card grabber overlay screen to harvest the card number, CVV, Date.

- generic grabber 2B 25281 2529 - Banking Malware “Ginp” Steal Card Info via Screen Overlay Attack

Researchers confirmed that the currently active version targeting a total of 24 unique apps. “In a 5-month timespan, the actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or capabilities.” Researcher said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.





Source link

No tags for this post.

LEAVE A REPLY

Please enter your comment!
Please enter your name here