General

  • Target

    fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1.bin

  • Size

    4.6MB

  • MD5

    74f5f2ccbef78824261c88e69a5a4dcc

  • SHA1

    b1fe80fd4bdec1d00663f7b8d778af7492438b5c

  • SHA256

    fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1

  • SHA512

    af14b52d996b560a0b0bfe1875f5e9d96b7128ae4abeba41e63f39a5c025b9f4089a16b0756f0e74a608fed1e6f2310369a0afd9d3eb2d767a0c9db06d24a761

  • SSDEEP

    98304:4dp6yLSLCO+r3WMfkziMabCrV1ozm+I/SP+ZFmd+8kbkeAwu6cLv:4dp6yB/NkwCRiiD6P+ZFN8Ol06cb

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/paperokomozase

Signatures

  • Godfather family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 1 IoCs

Files

  • fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1.bin
    .apk android

    com.asymmetrically.essayical

    com.asymmetrically.essayical.Congresso


  • app.apk
    .apk android

    com.hydromania.rerelate

    com.hydromania.rerelate.lampheated


Android Permissions

fd3a179dfac714ab9576d6e4679a9e3cc9768591721c34dd2d7d02c160ef18b1.bin

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES