General

  • Target

    35e2ec4c6aa33d623ceb1dffaa85c44e163a8b11d794cee20925100e340e0b31.bin

  • Size

    4.6MB

  • Sample

    240626-1w5anaygmq

  • MD5

    012aa26b381a7b2f4305604a027f1efc

  • SHA1

    fb2cbc93bd5650f8f7670b2f945d32b0e954556e

  • SHA256

    35e2ec4c6aa33d623ceb1dffaa85c44e163a8b11d794cee20925100e340e0b31

  • SHA512

    736b52d703b1d0eb33324adab9810d03aa19a73f5d5cb0a07d90140cb14b1cad300e7f75ae92ad0504fc801df9fb49e5687214e697f5e3ec9c761f0b03cbf43a

  • SSDEEP

    98304:QjpJ0PdiOQQWIkZ4ktcloXZV/HEokM+3I0AsMCloP7ahTzgOv:KpOPd/QQ/kZzz7EokvI0AtCC+ngOv

Malware Config

Extracted

Family

godfather

C2

https://t.me/paperokomozase

Targets

    • Target

      35e2ec4c6aa33d623ceb1dffaa85c44e163a8b11d794cee20925100e340e0b31.bin

    • Size

      4.6MB

    • MD5

      012aa26b381a7b2f4305604a027f1efc

    • SHA1

      fb2cbc93bd5650f8f7670b2f945d32b0e954556e

    • SHA256

      35e2ec4c6aa33d623ceb1dffaa85c44e163a8b11d794cee20925100e340e0b31

    • SHA512

      736b52d703b1d0eb33324adab9810d03aa19a73f5d5cb0a07d90140cb14b1cad300e7f75ae92ad0504fc801df9fb49e5687214e697f5e3ec9c761f0b03cbf43a

    • SSDEEP

      98304:QjpJ0PdiOQQWIkZ4ktcloXZV/HEokM+3I0AsMCloP7ahTzgOv:KpOPd/QQ/kZzz7EokvI0AtCC+ngOv

    Score
    4/10
    • Target

      app.apk

    • Size

      3.9MB

    • MD5

      abd81cf3135d94171f458a9fd1daa846

    • SHA1

      a9396a706bcf7b36927a6b12e34545c6836fed03

    • SHA256

      36d899b738f0b6dd577c1222f51a0bb19cd038690d39c7b6be4e4c4c3687e2c4

    • SHA512

      b4e5232125ae0db2f33e3ae763b0a7b71bc0eef12262451d1c46ac9208c155748f4f3cde0310f75fe9484a2daa737670fa66e473f8b0275f297b1b180d26b49b

    • SSDEEP

      98304:7u/zIKslV+cJ3ooy5UC/SgWc624SY/j+p1c:7uKVpoomJSgWhSYCTc

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks