Resubmissions

19-01-2023 08:14

230119-j49rnscd7v 10

23-12-2022 07:37

221223-jgaztsbc6z 8

General

  • Target

    8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

  • Size

    4.4MB

  • MD5

    8c3f5de84c7c233f7acdcc1985013fb9

  • SHA1

    1e49f4034eb0604c38f32097bb3ed32efe4e0426

  • SHA256

    8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

  • SHA512

    51be8f527b3433ece7a64a7fc4f979f4cc79e97e3fef4d7fe22530c6432a8f17e485c4f9c55eae5bba5237bb5478be677abc57366edf4ac73fb2a8accc972aff

  • SSDEEP

    98304:LkqWvyZXT7Z1dHGTcm5zlJfWemnetrYG9raBcdywwqzfr9+vf:FoyZMwm9ZQett9rMcdy7xf

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/varezotukomirza

Signatures

  • Godfather family
  • Requests dangerous framework permissions 5 IoCs

Files

  • 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.nordvpn.android

    com.nordvpn.android.unthawhemangiomatosis


Android Permissions

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.CALL_PHONE

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DISABLE_KEYGUARD

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.UPDATE_DEVICE_STATS

android.permission.MODIFY_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.QUERY_ALL_PACKAGES

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

oppo.permission.OPPO_COMPONENT_SAFE