Extracted

• • Target

    Godfather.apk

  • Size

    5.8MB

  • MD5

    c685ca051d3ca0cdee08f5a33a548031

  • SHA1

    e2757e1edd96238202862ba5e7f926f5a3911e17

  • SHA256

    138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

  • SHA512

    fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527

  • SSDEEP

    98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2

  Score

  10^/10

  godfatherbankerevasioninfostealerransomwaretrojan

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather

  • Renames multiple (140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Renames multiple (92) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Requests enabling of the accessibility settings.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2