Analysis
- max time kernel
3373963s - max time network
150s - platform
android_x64 - resource
android-x64-arm64-20220823-en - resource tags
- submitted
19/01/2023, 08:14
General
- Target 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23.apk
- Size 4.4MB
- Sample230119-j49rnscd7v
- SHA256 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23
Score
10/10
Malware Config
Signatures
- GodFather
GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.
- Makes use of the framework's Accessibility service. 3 IoCs
- Acquires the wake lock. 1 IoCs
- Requests enabling of the accessibility settings. 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.nordvpn.android1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
com.nordvpn.android_preferences.xml