General

  • Target

    fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1.bin

  • Size

    4.6MB

  • Sample

    240616-3hybastdjf

  • MD5

    74f5f2ccbef78824261c88e69a5a4dcc

  • SHA1

    b1fe80fd4bdec1d00663f7b8d778af7492438b5c

  • SHA256

    fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1

  • SHA512

    af14b52d996b560a0b0bfe1875f5e9d96b7128ae4abeba41e63f39a5c025b9f4089a16b0756f0e74a608fed1e6f2310369a0afd9d3eb2d767a0c9db06d24a761

  • SSDEEP

    98304:4dp6yLSLCO+r3WMfkziMabCrV1ozm+I/SP+ZFmd+8kbkeAwu6cLv:4dp6yB/NkwCRiiD6P+ZFN8Ol06cb

Malware Config

Extracted

Family

godfather

C2

https://t.me/paperokomozase

Targets

    • Target

      fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1.bin

    • Size

      4.6MB

    • MD5

      74f5f2ccbef78824261c88e69a5a4dcc

    • SHA1

      b1fe80fd4bdec1d00663f7b8d778af7492438b5c

    • SHA256

      fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1

    • SHA512

      af14b52d996b560a0b0bfe1875f5e9d96b7128ae4abeba41e63f39a5c025b9f4089a16b0756f0e74a608fed1e6f2310369a0afd9d3eb2d767a0c9db06d24a761

    • SSDEEP

      98304:4dp6yLSLCO+r3WMfkziMabCrV1ozm+I/SP+ZFmd+8kbkeAwu6cLv:4dp6yB/NkwCRiiD6P+ZFN8Ol06cb

    Score
    4/10
    • Target

      app.apk

    • Size

      3.9MB

    • MD5

      34352a61274fbca322ab62105cc0bf08

    • SHA1

      d6be2132ab58b862ccd438e53d4abe2cd7daddb4

    • SHA256

      46cde1578f7bf3be5c4af7f375c58ad7a12ea4052eb5db122799f04963897f5a

    • SHA512

      6ffe8fc62ef088ffed45581d61a7a9b36abe344feee6626705f65ec81d92677844be8b7ea652ca3caa5666f6ca8295ddf7993aa3485d83a4c85608ba4ee49ccd

    • SSDEEP

      98304:lvIZEwrXfdCW1CoCbIrxNY9A6U5aDE+HJdot3iDxvwwTx+sC:lwZE4QcoIgqRIDE+pdYixww+sC

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks