General

  • Target

    bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1.bin

  • Size

    4.6MB

  • Sample

    240519-1x6vwacd31

  • MD5

    c4a3c4d3bb04f8675750fca3fdf40c64

  • SHA1

    7c0e4390ae1e0ba84170aa904004685e79642f18

  • SHA256

    bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1

  • SHA512

    14856b76160d0a6b9487bd0330fb07fefab1df0d18b406e0c9d8d608769479e7aa03e687cabcfba33ff2a5c8658826503de9e2e7316689c4f9416e938abf9501

  • SSDEEP

    98304:AhdkVsiMloo5itCn6RSCnx81UUEaX1fROLbphc4s:AD2silkn6RLx8vVpOLUr

Malware Config

Extracted

Family

godfather

C2

https://t.me/napikozaremossod

Targets

    • Target

      bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1.bin

    • Size

      4.6MB

    • MD5

      c4a3c4d3bb04f8675750fca3fdf40c64

    • SHA1

      7c0e4390ae1e0ba84170aa904004685e79642f18

    • SHA256

      bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1

    • SHA512

      14856b76160d0a6b9487bd0330fb07fefab1df0d18b406e0c9d8d608769479e7aa03e687cabcfba33ff2a5c8658826503de9e2e7316689c4f9416e938abf9501

    • SSDEEP

      98304:AhdkVsiMloo5itCn6RSCnx81UUEaX1fROLbphc4s:AD2silkn6RLx8vVpOLUr

    Score
    4/10
    • Target

      i.apk

    • Size

      3.9MB

    • MD5

      fb4c92934dbb3c8b06893a391cfcc593

    • SHA1

      ee4aef0276ca2060c316a51e284bccfdcd0236fa

    • SHA256

      6fccf43370d620708259e3dd5046bad4b40f0711a1709f37f01fac66338e03c4

    • SHA512

      8be46c9bb5787d068a653aaa901794a54e0b99a72dcd3153fc093475bde4f8e6b3b6acf91929af6265c8975c3f83d6509e4b6dc36490c2492b5c45e372c9d540

    • SSDEEP

      98304:b4rXoGtpHajJeWisENxYO00wZ/Z4lNWmu4n:a3yeWixxY/PZ424n

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Prevents application removal

      Application may abuse the framework's APIs to prevent removal.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Acquires the wake lock

MITRE ATT&CK Mobile v15

Tasks