Resubmissions

09-02-2023 14:11

230209-rhjblafa7s 10

01-02-2023 07:33

230201-jdjgsscd37 10

General

  • Target

    3.apk

  • Size

    5.8MB

  • MD5

    c685ca051d3ca0cdee08f5a33a548031

  • SHA1

    e2757e1edd96238202862ba5e7f926f5a3911e17

  • SHA256

    138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

  • SHA512

    fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527

  • SSDEEP

    98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/varezotukomirza

Signatures

  • Godfather family
  • Requests dangerous framework permissions 5 IoCs

Files

  • 3.apk
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.expressvpn.vpn

    com.expressvpn.vpn.kittenspreachers


Android Permissions

3.apk

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.CALL_PHONE

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DISABLE_KEYGUARD

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.UPDATE_DEVICE_STATS

android.permission.MODIFY_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.QUERY_ALL_PACKAGES

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

oppo.permission.OPPO_COMPONENT_SAFE