General

  • Target

    b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617.bin

  • Size

    3.7MB

  • MD5

    05781192a3945575577091bdae8821b8

  • SHA1

    1326ed12253a5a8cf4a0da8b764be81edae7829c

  • SHA256

    b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617

  • SHA512

    c0fa2a6829615e12dbb19476ed7b39c4852370ae4386dd3513b0d5ad05515de5ad8b42614dadcc774bd7c83af2422737051ae9a521f4c502b2ad72b10d8e665d

  • SSDEEP

    98304:EAmuECVyE78uJDvnrrT6qCYtEXvX7kI9UtsuiD:HWu1r3nCBrk5CuiD

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/intpravitokasero

Signatures

  • Godfather family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 1 IoCs

Files

  • b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617.bin
    .apk android

    com.tolstoyan.seismotherapy

    com.tolstoyan.seismotherapy.ringless


Android Permissions

b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617.bin

Permissions

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WAKE_LOCK

android.permission.POST_NOTIFICATIONS

android.permission.QUERY_ALL_PACKAGES

com.tolstoyan.seismotherapy.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION