Overview

overview

10

Static

static

10

8d07967b92...23.apk

android-9-x86

10

8d07967b92...23.apk

android-11-x64

10

Resubmissions

19-01-2023 08:14

230119-j49rnscd7v 10

23-12-2022 07:37

221223-jgaztsbc6z 8

Analysis

  • max time kernel
    3370352s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    19-01-2023 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23.apk

  • Size

    4.4MB

  • MD5

    8c3f5de84c7c233f7acdcc1985013fb9

  • SHA1

    1e49f4034eb0604c38f32097bb3ed32efe4e0426

  • SHA256

    8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

  • SHA512

    51be8f527b3433ece7a64a7fc4f979f4cc79e97e3fef4d7fe22530c6432a8f17e485c4f9c55eae5bba5237bb5478be677abc57366edf4ac73fb2a8accc972aff

  • SSDEEP

    98304:LkqWvyZXT7Z1dHGTcm5zlJfWemnetrYG9raBcdywwqzfr9+vf:FoyZMwm9ZQett9rMcdy7xf

Score
10/10
godfatherbankerevasioninfostealerransomwaretrojan

Malware Config

Signatures

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.nordvpn.android
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nordvpn.android/shared_prefs/com.nordvpn.android_preferences.xml
    Filesize

    166B

    MD5

    9f47baf3a9a6194affde23f6045a061d

    SHA1

    5f7777d88f68d11406d777a6221b79c66de22837

    SHA256

    8300e9295420e9621c996b1e23bdc1c65a6707f72e12b73309667f7762917f50

    SHA512

    cf224e18a29b3794f07cf96cdb1bbaf1ddaa6c56867429b02e93a173f262377721244383c2aad24ed46c6e9411e0ad8f4fdd7828de7c45c561fabb01836f9348

    Download Submit