General

  • Target

    c66b09e3021050f080e06c9aad6358a351b5a371328b131e8c7b08a555786c80.bin

  • Size

    4.4MB

  • Sample

    240716-1xbpqssbnl

  • MD5

    afc4b2c7772ab99dc168b8b1881e119b

  • SHA1

    4484b5149b3c40780d718e7c7a778ce2d243fea2

  • SHA256

    c66b09e3021050f080e06c9aad6358a351b5a371328b131e8c7b08a555786c80

  • SHA512

    54e6f5d29a1c21095db5fd0c1b5f75209de70bfc9e4805cf26a09b41c7aa99cd7334ba61f1893385b8e6cc27e74ec76a108140f05f8d8c0abb2a9850d05f6761

  • SSDEEP

    98304:YB9ANsYfV+T3oxe0piCldK3SFnTnSvMEcauNUnif2QjWlj9Egz:YB92sYfGhAHGYIFBuN+j9Egz

Malware Config

Extracted

Family

godfather

C2

https://t.me/insgaramerbosake

Targets

    • Target

      c66b09e3021050f080e06c9aad6358a351b5a371328b131e8c7b08a555786c80.bin

    • Size

      4.4MB

    • MD5

      afc4b2c7772ab99dc168b8b1881e119b

    • SHA1

      4484b5149b3c40780d718e7c7a778ce2d243fea2

    • SHA256

      c66b09e3021050f080e06c9aad6358a351b5a371328b131e8c7b08a555786c80

    • SHA512

      54e6f5d29a1c21095db5fd0c1b5f75209de70bfc9e4805cf26a09b41c7aa99cd7334ba61f1893385b8e6cc27e74ec76a108140f05f8d8c0abb2a9850d05f6761

    • SSDEEP

      98304:YB9ANsYfV+T3oxe0piCldK3SFnTnSvMEcauNUnif2QjWlj9Egz:YB92sYfGhAHGYIFBuN+j9Egz

    Score
    4/10
    • Target

      up.apk

    • Size

      3.7MB

    • MD5

      3658e9292d8c0b5f2457e25779a75a86

    • SHA1

      6a5fb266fecf5770e94d5b98bda8a09dd53b73f6

    • SHA256

      606b34104c31fc4210ee6f0efa7d30e4b6de93b3cb4be95db46066572f7ee8e5

    • SHA512

      4e332ed18a373e9c70ef165e14ee32647a4086109e6b02d56c6c482faf09d5009992c164632a21fa7cc99e4b484b41997264fb00f384b27d45bf97c783bf3202

    • SSDEEP

      98304:+j8kuL6FfQ+qURYZFK70DrJFGbCio04NeIi3aS/Y:hd4OTM0rmVn4NeIyY

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks