General

  • Target

    2a2f7c941ba799e9c46577f0b4d3d2e1db286a83379bf46f2a2a1002f9bf56ef.bin

  • Size

    4.6MB

  • Sample

    240709-1xsy1szeqd

  • MD5

    57f0dcd590e74503458ee38c80438ce0

  • SHA1

    2d79e02d35c8897cdf3c3e59a8802462424fccda

  • SHA256

    2a2f7c941ba799e9c46577f0b4d3d2e1db286a83379bf46f2a2a1002f9bf56ef

  • SHA512

    7635be76db64f33466f7d2b3ba41968e4bf205e82548cf0e401f47023c2c702143b765f510607e3767223de97113dbe2d27370a15e24e0f64bdb2102cfb7191e

  • SSDEEP

    98304:bgvytJGPNSgxNoKDofPWMqzD6DrjnSy9LNREL4e83uLTEk:bgvytqNSANoMonWMqzDmbdL9k

Malware Config

Extracted

Family

godfather

C2

https://t.me/trinomazkonera

Targets

    • Target

      2a2f7c941ba799e9c46577f0b4d3d2e1db286a83379bf46f2a2a1002f9bf56ef.bin

    • Size

      4.6MB

    • MD5

      57f0dcd590e74503458ee38c80438ce0

    • SHA1

      2d79e02d35c8897cdf3c3e59a8802462424fccda

    • SHA256

      2a2f7c941ba799e9c46577f0b4d3d2e1db286a83379bf46f2a2a1002f9bf56ef

    • SHA512

      7635be76db64f33466f7d2b3ba41968e4bf205e82548cf0e401f47023c2c702143b765f510607e3767223de97113dbe2d27370a15e24e0f64bdb2102cfb7191e

    • SSDEEP

      98304:bgvytJGPNSgxNoKDofPWMqzD6DrjnSy9LNREL4e83uLTEk:bgvytqNSANoMonWMqzDmbdL9k

    Score
    4/10
    • Target

      up.apk

    • Size

      3.9MB

    • MD5

      cf9d2e1299ae11006cc68edf1f3022e7

    • SHA1

      0c3188a437f186afa4ce6c33f94b04b57a5ca617

    • SHA256

      cc5235faae1b319d1ff1f9eae5f22827f4b43cf89a2a5747f420df99cf7dbe90

    • SHA512

      fd30102ac473bc7382d0b20f8db06a022907cc6958419a1693565a84445d0855622611b0cf69292d2db850d4755f1b85b76e15e4605253cc2446221cd03371c3

    • SSDEEP

      98304:2mF5QsxtodIow/gtd0/DTzs7/RTrvvaoUBrqS4d:1hEIow/gtdC85vFUYS4d

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks