godfather | 9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385[.]bin

General

Target
9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin
Size 4.7MB
Sample240601-2yrb9aae42
SHA256 9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385
MD5 250bb2e19a5201b2f94c58bade583a48
SHA1 16ed757e508f2b50319479ecadd09bb913b4fc48
SHA512 119dee2a72200bf65f9f835b60cb6e4f1b4e5ae9c188c51bdf3405adc082f46f43593a8bc089c8d99f1dc73b8f82c011c70525e8b77001009630747d7ea657fc
SSDEEP 98304:vB8IlBYuV0wIO3Ca9Vbley/tarfPh+zkYB3XWNTyqOEMK3jQ1:vf7FIO3mYt9q26Q1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

godfather

Malware Config

Extracted

Family

godfather

C2

https://t.me/intpravitokasero

Signatures

Godfather family
godfather

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

.apk 4.7MB
i.apk

.apk 3.7MB

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

SHA256 9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385
MD5 250bb2e19a5201b2f94c58bade583a48
SHA1 16ed757e508f2b50319479ecadd09bb913b4fc48
SHA512 119dee2a72200bf65f9f835b60cb6e4f1b4e5ae9c188c51bdf3405adc082f46f43593a8bc089c8d99f1dc73b8f82c011c70525e8b77001009630747d7ea657fc
SSDEEP 98304:vB8IlBYuV0wIO3Ca9Vbley/tarfPh+zkYB3XWNTyqOEMK3jQ1:vf7FIO3mYt9q26Q1
MD5 SHA1 SHA512 SSDEEP

android

com.coalas.twiddlers

i.apk

SHA256 594d6694bf83657b974cc4ac6c6fbec14c84680f343d7547f000423dbd5f957d
MD5 f8540764ac58575f150cc992ad241a5d
SHA1 eccc50efe5dd4d494b572433a39efa08d8092482
SHA512 1ac4e29275a3aa70990c26973333e36b5d62b22ca854642fc8295a36f8a9f0e8dcc0cb9ae372f0c49c3b715516af4eefc0bbba87d9bbb22ba59f72f2e0f8f2a9
SSDEEP 98304:ry/wVk+PJgvJQ4boVqLcIJVryNaalQ1szWsUxJ:ry/8YU2PryrJKsUT
MD5 SHA1 SHA512 SSDEEP

android

com.backstay.miscommunicate

Android Permissions

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

Permissions

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

com.coalas.twiddlers.goldweight

com.coalas.twiddlers.Wolffian

com.coalas.twiddlers.julolidine

i.apk

com.backstay.miscommunicate.faintnesses

com.backstay.miscommunicate.dystopia

com.backstay.miscommunicate.hypnoid

com.backstay.miscommunicate.dense

com.google.android.gms.common.api.GoogleApiActivity

com.backstay.miscommunicate.thincheeked

com.backstay.miscommunicate.welcomeness

com.backstay.miscommunicate.angelomachy

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

com.coalas.twiddlers.goldweight

com.coalas.twiddlers.Wolffian

com.coalas.twiddlers.julolidine

i.apk

com.backstay.miscommunicate.faintnesses

com.backstay.miscommunicate.dystopia

com.backstay.miscommunicate.hypnoid

com.backstay.miscommunicate.dense

com.google.android.gms.common.api.GoogleApiActivity

com.backstay.miscommunicate.thincheeked

com.backstay.miscommunicate.welcomeness

com.backstay.miscommunicate.angelomachy

androidx.startup.InitializationProvider

Android Permissions

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin