A new variant of the Adobe Flash Player trojan has emerged.

Recently, the Shadow Security Lab discovered a new trojan virus named Ginp during its daily monitoring. Although its name is very similar to the 'Flash Player' trojan virus described in the 'Counterintelligence Journey 004' report released two weeks ago, they belong to different virus families.

The original version of the malicious software can be traced back to early June 2019, when it was disguised as the 'Google Play Verificator' application. At that time, Ginp was a simple SMS thief, and its purpose was simply to send copies of the user's received and sent SMS messages to the C2 server.

In August 2019, a new version was released, which added features unique to banking trojans. This malicious software is disguised as a fake 'Adobe Flash Player' application, and the malicious software code has enhanced anti-obfuscation capabilities. Ginp, compared to the 'Flash Player' trojan virus released two weeks earlier, in addition to having the characteristics of trojan viruses commonly used to remotely control and obtain users' contact lists, SMS lists, and other private information, also monitors the user's device through registered accessibility services, automatically authorizes sensitive application privileges, loads web pages to overlay specific application pages, and the purpose is to steal login credential information.

First, sample information

MD5: 1EA4002F712DE0D9685D3618BA2D0A13

Program name: Adobe Flash Player

Package name: solution.rail.forward

Install icon:

Second, detailed analysis

When the malicious software is first launched on the device, it hides the icon and requires the victim to provide accessibility service privileges.

Once the user grants the requested accessibility service privileges, Ginp first automatically grants itself additional privileges to perform certain sensitive high-privilege operations without any further action from the victim. After completion, the malicious program can work normally, receive commands, and execute overlay attacks.

Detect configuration information and send the information to the server. This makes it convenient for the control end to judge which operations can be executed on the victim's machine based on the configuration information.

Figure 2-1 Getting Application Configuration Information

Monitor the server's response status, obtain commands issued by the C2 server, steal user contact lists, SMS lists, and other information. Send specified SMS content to a specified contact, the purpose is to spread malicious software.

Figure 2-2 Getting C2 Server Commands

Command List

Table 2-1 Command List

Monitor user device operation events through AccessibilityService.

Figure 2-3 Monitor User Device

Perform the following operations:

(1) Update application list, automatically download and install software: Obtain the application download link from the server, download the application and open the installation interface, when the system pops up the installation interface, traverse the nodes, and execute click to agree to authorization through perforAcmtion.

Figure 2-4 Request Installation Interface

(2) Automatically grant high-sensitive permissions: Apply for the permission to receive and send SMS, when the system pops up a permission request, traverse the nodes, and execute click to agree to authorization through perforAcmtion.

Figure 2-5 Automatic Authorization, Install Software

(3) Self-protection, prevent deletion: When the monitored interface contains 'force' forced stop, 'app info' application list, the program exits to the HOME interface, so the user cannot uninstall the software by checking the application list.

Figure 2-6 Open HOME Interface

(4) Covering Attack: Monitor the applications opened by the user, obtain web covers for target applications from the server, simulate real application pages for covering, to steal user login credentials.

Figure 2-7 Covering Target Application

Target Software:

Google Play

Facebook

Instagram

Whatsapp

Chrome

Skype

Twitter

Snapchat

The following screenshot shows what type of information is collected during a covering attack:

Figure 2-8 Covering Attack Web Page

Set the malware as the default SMS application. Monitor the sending and receiving of user SMS.

Figure 2-9 Listening to User SMS

3. Server Address

Table 3-1 Server Address

IV. Same Origin Samples

Samples with the same server addresses found in monitoring. Although the current target of this trojan virus is some social software, it may be updating another new version of malicious software to target banks, to steal more sensitive information from users, such as: *** information, *** information, to obtain profits.

Table 4-1 Same Origin Samples

V. Security Recommendations

Since malicious software has protected itself, users cannot uninstall it through normal methods. The following methods can be used to uninstall it.

(1) Connect the phone to the computer, enter the command: adb shell pm uninstall package name on the control end.

(2) Enter the /data/data directory or /data/app directory on the phone, and uninstall the folder with the application package name, the application will not work.

(3) Installing antivirus software can effectively identify known viruses.

Many attackers spread malicious software through text messages, so users should not easily click on text messages with links.

Always download software from official app stores or websites, and be cautious when downloading from forums or other untrusted websites.

*Author: Shadow Security Lab, please indicate the source as FreeBuf.COM when转载.