godfather | bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230[.]bin

General

Target
bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin
Size 4.6MB
Sample240713-1xt63syflj
SHA256 bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230
MD5 d8af6624ffb6113e911c163173852eb5
SHA1 bb5c389692ca6ba45d81edafcf970bbd2a37e15d
SHA512 5fd0b6e5d9916229e6274766d978f3ffc4be3c714947efc985bce3005a9699377e2d8ddc7e630dc1e7d71b851313651377f9783b785cdce5fef293c7b079d6d6
SSDEEP 49152:HXGjkmLqGb2a2u6MppgzGP0FdJEbXeKaG7HZVOHDF1g+vxSHB9nuujpTctu5CyOw:HwKTNI0FdQzax7SHnnhiyOS/RTIIHSY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

godfather

Malware Config

Extracted

Family

godfather

C2

https://t.me/trinomazkonera

Signatures

Godfather family
godfather

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin

.apk 4.6MB
up.apk

.apk 3.9MB

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin

SHA256 bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230
MD5 d8af6624ffb6113e911c163173852eb5
SHA1 bb5c389692ca6ba45d81edafcf970bbd2a37e15d
SHA512 5fd0b6e5d9916229e6274766d978f3ffc4be3c714947efc985bce3005a9699377e2d8ddc7e630dc1e7d71b851313651377f9783b785cdce5fef293c7b079d6d6
SSDEEP 49152:HXGjkmLqGb2a2u6MppgzGP0FdJEbXeKaG7HZVOHDF1g+vxSHB9nuujpTctu5CyOw:HwKTNI0FdQzax7SHnnhiyOS/RTIIHSY
MD5 SHA1 SHA512 SSDEEP

android

com.upstandingly.nonprudential

up.apk

SHA256 bfbdf0a2190cc3568dd07f50be86a681035fb6371c2e3b056db6cbf2a9b35279
MD5 0ee55e7dda5ca16de0519b60096ba709
SHA1 aeec7b300857cc3682309cbe23da177c13464f70
SHA512 15e8413422e177eecbfd4f5791efbdee7944f94a0022a4e72154df5598a17318895487dc30cb1aea37007b3195a69f132eed7b3a41a2bce09ffdca48ec4d34c2
SSDEEP 98304:Qo0LdGO0F97nRGgNfOBhymZR0H54Ph/de+vwlz4UXB+F:QdEM0ShRZIWRd9M4M+F
MD5 SHA1 SHA512 SSDEEP

android

com.actiniums.phenomenologies

Android Permissions

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin

com.upstandingly.nonprudential.cometaria

com.upstandingly.nonprudential.metarabic

com.upstandingly.nonprudential.Eyla

up.apk

com.actiniums.phenomenologies.diazin

com.actiniums.phenomenologies.precleans

com.actiniums.phenomenologies.lawyery

com.actiniums.phenomenologies.cabaretier

com.google.android.gms.common.api.GoogleApiActivity

com.actiniums.phenomenologies.ankerhold

com.actiniums.phenomenologies.thymegrown

com.actiniums.phenomenologies.nailclipping

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin

com.upstandingly.nonprudential.cometaria

com.upstandingly.nonprudential.metarabic

com.upstandingly.nonprudential.Eyla

up.apk

com.actiniums.phenomenologies.diazin

com.actiniums.phenomenologies.precleans

com.actiniums.phenomenologies.lawyery

com.actiniums.phenomenologies.cabaretier

com.google.android.gms.common.api.GoogleApiActivity

com.actiniums.phenomenologies.ankerhold

com.actiniums.phenomenologies.thymegrown

com.actiniums.phenomenologies.nailclipping

androidx.startup.InitializationProvider

Android Permissions

bfa7c1433ba40a74c2dd2d4e9a6aa8e1654621dee61614631800f7889351a230.bin