Overview

overview

10

Static

static

10

3.apk

android-9-x86

10

3.apk

android-11-x64

10

Resubmissions

09-02-2023 14:11

230209-rhjblafa7s 10

01-02-2023 07:33

230201-jdjgsscd37 10

Analysis

  • max time kernel
    199706s
  • max time network
    165s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    01-02-2023 07:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3.apk

  • Size

    5.8MB

  • MD5

    c685ca051d3ca0cdee08f5a33a548031

  • SHA1

    e2757e1edd96238202862ba5e7f926f5a3911e17

  • SHA256

    138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

  • SHA512

    fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527

  • SSDEEP

    98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2

Score
10/10
godfatherbankerevasioninfostealerransomwaretrojan

Malware Config

Signatures

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.expressvpn.vpn
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4501

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.expressvpn.vpn/shared_prefs/com.expressvpn.vpn_preferences.xml
    Filesize

    166B

    MD5

    9f47baf3a9a6194affde23f6045a061d

    SHA1

    5f7777d88f68d11406d777a6221b79c66de22837

    SHA256

    8300e9295420e9621c996b1e23bdc1c65a6707f72e12b73309667f7762917f50

    SHA512

    cf224e18a29b3794f07cf96cdb1bbaf1ddaa6c56867429b02e93a173f262377721244383c2aad24ed46c6e9411e0ad8f4fdd7828de7c45c561fabb01836f9348

    Download Submit