godfather | 138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

Resubmissions

14/09/2026, 16:00

260914-tf2fhaeq3s10

14/09/2026, 10:57

11/04/2026, 07:54

09/02/2023, 14:11

01/02/2023, 07:33

Analysis

max time kernel
914823s
max time network
175s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
09/02/2023, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.apk
Size 5.8MB
Sample230209-rhjblafa7s
SHA256 138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4
MD5 c685ca051d3ca0cdee08f5a33a548031
SHA1 e2757e1edd96238202862ba5e7f926f5a3911e17
SHA512 fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527
SSDEEP 98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

godfather banker evasion infostealer ransomware trojan

Malware Config

Signatures

GodFather
GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.
banker trojan infostealer godfather

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.expressvpn.vpn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.expressvpn.vpn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.expressvpn.vpn

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.expressvpn.vpn

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.expressvpn.vpn

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.expressvpn.vpn

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.expressvpn.vpn

com.expressvpn.vpn
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4399

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

com.expressvpn.vpn_preferences.xml

Path /data/user/0/com.expressvpn.vpn/shared_prefs/com.expressvpn.vpn_preferences.xml
Size 166B
SHA256 8300e9295420e9621c996b1e23bdc1c65a6707f72e12b73309667f7762917f50
MD5 9f47baf3a9a6194affde23f6045a061d
SHA1 5f7777d88f68d11406d777a6221b79c66de22837
SHA512 cf224e18a29b3794f07cf96cdb1bbaf1ddaa6c56867429b02e93a173f262377721244383c2aad24ed46c6e9411e0ad8f4fdd7828de7c45c561fabb01836f9348
MD5 SHA1 SHA512

Submit Download