godfather | 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

General

Target
8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23
Size 4.4MB
Sample230119-j49rnscd7v
SHA256 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23
MD5 8c3f5de84c7c233f7acdcc1985013fb9
SHA1 1e49f4034eb0604c38f32097bb3ed32efe4e0426
SHA512 51be8f527b3433ece7a64a7fc4f979f4cc79e97e3fef4d7fe22530c6432a8f17e485c4f9c55eae5bba5237bb5478be677abc57366edf4ac73fb2a8accc972aff
SSDEEP 98304:LkqWvyZXT7Z1dHGTcm5zlJfWemnetrYG9raBcdywwqzfr9+vf:FoyZMwm9ZQett9rMcdy7xf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

godfather

Malware Config

Extracted

Family

godfather

C2

https://t.me/varezotukomirza

Signatures

Godfather family
godfather

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

File Explorer

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

.apk 4.4MB

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

SHA256 8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23
MD5 8c3f5de84c7c233f7acdcc1985013fb9
SHA1 1e49f4034eb0604c38f32097bb3ed32efe4e0426
SHA512 51be8f527b3433ece7a64a7fc4f979f4cc79e97e3fef4d7fe22530c6432a8f17e485c4f9c55eae5bba5237bb5478be677abc57366edf4ac73fb2a8accc972aff
SSDEEP 98304:LkqWvyZXT7Z1dHGTcm5zlJfWemnetrYG9raBcdywwqzfr9+vf:FoyZMwm9ZQett9rMcdy7xf
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

com.nordvpn.android

Android Permissions

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.CALL_PHONE

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DISABLE_KEYGUARD

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.UPDATE_DEVICE_STATS

android.permission.MODIFY_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.QUERY_ALL_PACKAGES

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

oppo.permission.OPPO_COMPONENT_SAFE

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

com.nordvpn.android.unthawhemangiomatosis

com.nordvpn.android.Activitys.nonsynchronicallyserpentarium

com.nordvpn.android.Activitys.heterochiralchoicedrawn

com.nordvpn.android.Activitys.primulaskhanjee

com.nordvpn.android.Activitys.nosingJacobba

com.nordvpn.android.Activitys.coinstantaneousnesswrothful

com.nordvpn.android.Activitys.foremeantLiptauer

com.nordvpn.android.Activitys.preappointsplane

com.nordvpn.android.Activitys.bluethGurl

com.nordvpn.android.Activitys.dorsumbonalHarlemite

com.nordvpn.android.Activitys.kharoubacattleless

com.nordvpn.android.Activitys.Novakrudders

com.nordvpn.android.Activitys.unsplendourousneurilemmal

com.nordvpn.android.Activitys.miraculardichopodial

com.viber.voip.MediaProjectionRequestActivity

com.google.android.gms.common.api.GoogleApiActivity

com.nordvpn.android.Services.remountallanite

com.nordvpn.android.Services.entertainmentprelatic

com.nordvpn.android.adluminestereotypical

com.nordvpn.android.Services.penthritFiberfrax

com.nordvpn.android.Services.becommamiens

com.nordvpn.android.Services.becryfalculate

com.nordvpn.android.Services.sealskinstarter

com.viber.voip.InputService

com.nordvpn.android.Network.lighthorsemengametogonium

com.viber.voip.MainService

com.nordvpn.android.Services.Sparganiaceaepsychotechnologist

com.nordvpn.android.Receivers.fideismmismaking

com.nordvpn.android.Receivers.crozingtranspires

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23

com.nordvpn.android.unthawhemangiomatosis

com.nordvpn.android.Activitys.nonsynchronicallyserpentarium

com.nordvpn.android.Activitys.heterochiralchoicedrawn

com.nordvpn.android.Activitys.primulaskhanjee

com.nordvpn.android.Activitys.nosingJacobba

com.nordvpn.android.Activitys.coinstantaneousnesswrothful

com.nordvpn.android.Activitys.foremeantLiptauer

com.nordvpn.android.Activitys.preappointsplane

com.nordvpn.android.Activitys.bluethGurl

com.nordvpn.android.Activitys.dorsumbonalHarlemite

com.nordvpn.android.Activitys.kharoubacattleless

com.nordvpn.android.Activitys.Novakrudders

com.nordvpn.android.Activitys.unsplendourousneurilemmal

com.nordvpn.android.Activitys.miraculardichopodial

com.viber.voip.MediaProjectionRequestActivity

com.google.android.gms.common.api.GoogleApiActivity

com.nordvpn.android.Services.remountallanite

com.nordvpn.android.Services.entertainmentprelatic

com.nordvpn.android.adluminestereotypical

com.nordvpn.android.Services.penthritFiberfrax

com.nordvpn.android.Services.becommamiens

com.nordvpn.android.Services.becryfalculate

com.nordvpn.android.Services.sealskinstarter

com.viber.voip.InputService

com.nordvpn.android.Network.lighthorsemengametogonium

com.viber.voip.MainService

com.nordvpn.android.Services.Sparganiaceaepsychotechnologist

com.nordvpn.android.Receivers.fideismmismaking

com.nordvpn.android.Receivers.crozingtranspires

Android Permissions

8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23