godfather | godfather[.]apk

General

Target

godfather.apk
Size

7.2MB
MD5

ec9f857999b4fc3dd007fdb786b7a8d1
SHA1

3fa48a36d22d848ad111b246ca94fa58088dbb7a
SHA256

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
SHA512

51d9965e08fa3f5cd8850df3f2dd8503c47ce9f3668b2ae90d3560cc16acd0d4d1b3bbed651d957bc41ea7595a527a00b9c600b3726faa6095af380019e3d1e0
SSDEEP

98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR

Score

10^/10

godfather

Malware Config

Extracted

Family

godfather

C2

https://t.me/dobrynyanikitichsobre

Signatures

Godfather family
godfather

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

godfather.apk
.apk android

com.rduzmauwns.jieliysagr

com.rduzmauwns.jieliysagr.aJtzcrQbcpuSYfz

Activities

com.rduzmauwns.jieliysagr.aJtzcrQbcpuSYfz

android.intent.action.MAIN

com.rduzmauwns.jieliysagr.znZoKdwDNzBoiel

android.intent.action.SEND
android.intent.action.SENDTO

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.GET_TASKS
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.BROADCAST_SMS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SMS
android.permission.PACKAGE_USAGE_STATS
android.permission.CALL_PHONE
android.permission.SEND_SMS
android.permission.RECORD_AUDIO
android.permission.READ_CONTACTS
android.permission.READ_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WAKE_LOCK
android.permission.DISABLE_KEYGUARD

Receivers

com.rduzmauwns.jieliysagr.Receivers.tmwsCsbPsRrMQuR

android.provider.Telephony.SMS_DELIVER

com.rduzmauwns.jieliysagr.Receivers.gGUeKBMytRkcohg

android.provider.Telephony.WAP_PUSH_DELIVER

com.rduzmauwns.jieliysagr.Receivers.UyPEynbQaBYnvos

android.provider.Telephony.SMS_RECEIVED

com.rduzmauwns.jieliysagr.Receivers.dntwRvykDLjCMia

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT

com.rduzmauwns.jieliysagr.Receivers.oKijgXhIueVuKBo

android.app.action.DEVICE_ADMIN_ENABLED

Services

net.godfather.thegodfather.InputService

android.accessibilityservice.AccessibilityService

com.rduzmauwns.jieliysagr.Services.twiYVbbysorooCS

android.intent.action.RESPOND_VIA_MESSAGE

Android Permissions

godfather.apk

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_TASKS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.BROADCAST_SMS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SMS

android.permission.PACKAGE_USAGE_STATS

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.RECORD_AUDIO

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.DISABLE_KEYGUARD

Sharing

General

Malware Config

Extracted

Signatures

Files

com.rduzmauwns.jieliysagr

com.rduzmauwns.jieliysagr.aJtzcrQbcpuSYfz

Activities

com.rduzmauwns.jieliysagr.aJtzcrQbcpuSYfz

com.rduzmauwns.jieliysagr.znZoKdwDNzBoiel

Permissions

Receivers

com.rduzmauwns.jieliysagr.Receivers.tmwsCsbPsRrMQuR

com.rduzmauwns.jieliysagr.Receivers.gGUeKBMytRkcohg

com.rduzmauwns.jieliysagr.Receivers.UyPEynbQaBYnvos

com.rduzmauwns.jieliysagr.Receivers.dntwRvykDLjCMia

com.rduzmauwns.jieliysagr.Receivers.oKijgXhIueVuKBo

Services

net.godfather.thegodfather.InputService

com.rduzmauwns.jieliysagr.Services.twiYVbbysorooCS

Android Permissions

godfather.apk