Overview

overview

10

Static

static

10

4067b5b04e...44.apk

android-9-x86

8

4067b5b04e...44.apk

android-10-x64

10

4067b5b04e...44.apk

android-11-x64

8

Analysis

  • max time kernel
    574605s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20230621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230621-enlocale:en-usos:android-10-x64system
  • submitted
    23-08-2023 11:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4067b5b04e75d56b634fc0a62641f993c0e29c0a24e31a1170dc69bb312fc044.apk

  • Size

    3.1MB

  • MD5

    4eea28c432eb356d9ea32c3540192d9a

  • SHA1

    89fe8937fbb16b46974773a781d3c1decf64b6f1

  • SHA256

    4067b5b04e75d56b634fc0a62641f993c0e29c0a24e31a1170dc69bb312fc044

  • SHA512

    31555b9ec8fefe9f0cd7cef84655cdc9d2b59c793c6331918f8a644a259210af8d469d2df3b5b9bb5830c7dbfae50fc3ba6f40da7a24a02f50872d02d108632c

  • SSDEEP

    98304:l1Oh0qnoPMnH2o9dju6zfJNvbQ4dpTrgmSlzfrDzCxFW:rOh3oP0PpdSmVxFW

Score
10/10
godfatherbankerinfostealerransomwarestealthtrojan

Malware Config

Extracted

Family

godfather

C2

https://t.me/rapmanterkorezimor

Signatures

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.reallybadapps.podcastguru
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4814

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /apex/com.android.runtime/javalib/core-oj.jar
    Filesize

    4.7MB

    MD5

    7e343cbc45b618d05182d74bd61826b2

    SHA1

    02ee96263b3b967e570e8ddb1fa36cb21032b71b

    SHA256

    324b5af2ec2d78bb57b1552f429af51ac8d65f7fa277217ae8d4371ab14178d1

    SHA512

    48cbd8a5b246cf9d6ec16558ab12af131439837094c63a64046de384da933593459fb1aec126393bbe3b2b8ca19437f38b68364c9f158023a7b1a35e6901c705

    Download Submit

  • [anon:dalvik-classes.dex extracted in memory from /data/app/com.reallybadapps.podcastguru-X9RZJwEt92SzM2ze-KG-PQ==/base.apk]
    Filesize

    4.1MB

    MD5

    47178b2700b35894347269c45bae0960

    SHA1

    e12fc7f3cca154ff51512f3d0f4b3baa376c305e

    SHA256

    e8641c7a6a62d7c47b78c605d3dab36e0398df9f804813dc80fbf09b3eef258e

    SHA512

    61ae04a7de7fa491655c5dbefcb56a3a4996feca27612d16dfb272358904b1a6d54bedcd3cee1ef8b758414c7ff950db2d5f063ce4a03d4f3705beb3444e259f

    Download Submit