General

  • Target

    96120d1868c5471d7f9728411f244f0cdbc0e279cdee6f6705f772661c1305c4.bin

  • Size

    4.6MB

  • MD5

    8690d615d64773dca6f6300372b8a24d

  • SHA1

    0f6ddb687581fa33f484808b18608ec93e47cd9c

  • SHA256

    96120d1868c5471d7f9728411f244f0cdbc0e279cdee6f6705f772661c1305c4

  • SHA512

    a0b541f0175d7c2352008e096ccbee09e8f86d44a910098aea28b7935067ebf255562cc4e2303aadc844e36d7ed6a687b719fb4e0ab1dc5ab1f0f3af28dc6e50

  • SSDEEP

    98304:+98LUAzwcqAW2yvV5etZNEzoPM2Ro6xrOcBCWlPS2ulNQu:+98L55W2yvV5etZqK5oer34WlPS2u/Qu

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/napikozaremossod

Signatures

  • Godfather family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 1 IoCs

Files

  • 96120d1868c5471d7f9728411f244f0cdbc0e279cdee6f6705f772661c1305c4.bin
    .apk android

    com.essay.existently

    com.essay.existently.Cercopidae


  • i.apk
    .apk android

    com.phyllite.problemdom

    com.phyllite.problemdom.actinautographic


Android Permissions

96120d1868c5471d7f9728411f244f0cdbc0e279cdee6f6705f772661c1305c4.bin

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES