General

  • Target

    eb64a1dfd9711261caa9e9b13ee7fbe63220f495e7bda8c58da3ef33fd0fe50b.bin

  • Size

    4.6MB

  • Sample

    240905-1w5ana1fqb

  • MD5

    a3e16e79c3a9004b223df98c086846a2

  • SHA1

    7fe32d336281a052ccb425af323043aa96aab817

  • SHA256

    eb64a1dfd9711261caa9e9b13ee7fbe63220f495e7bda8c58da3ef33fd0fe50b

  • SHA512

    87723130ef15f01a2ee49ae6bff6f7e050c9a0cfeb0346586084f87b63998f8f3921c776f55a7e793c81c352ef981983430100a83bc5aa4149a168c3ac70f74c

  • SSDEEP

    98304:BY1CLdYw51+O8rpha9K7VhLgpGkqAqoEQH:G1Ugtre9Kb8sk5H

Malware Config

Extracted

Family

godfather

C2

https://t.me/zamukosaremopas

Targets

    • Target

      eb64a1dfd9711261caa9e9b13ee7fbe63220f495e7bda8c58da3ef33fd0fe50b.bin

    • Size

      4.6MB

    • MD5

      a3e16e79c3a9004b223df98c086846a2

    • SHA1

      7fe32d336281a052ccb425af323043aa96aab817

    • SHA256

      eb64a1dfd9711261caa9e9b13ee7fbe63220f495e7bda8c58da3ef33fd0fe50b

    • SHA512

      87723130ef15f01a2ee49ae6bff6f7e050c9a0cfeb0346586084f87b63998f8f3921c776f55a7e793c81c352ef981983430100a83bc5aa4149a168c3ac70f74c

    • SSDEEP

      98304:BY1CLdYw51+O8rpha9K7VhLgpGkqAqoEQH:G1Ugtre9Kb8sk5H

    Score
    4/10
    • Target

      up.apk

    • Size

      3.9MB

    • MD5

      8b83ff50b4b15eefe846ec24e750091c

    • SHA1

      fe59eb92b1a27f7a7a64f6d319e38e5ef8b596d5

    • SHA256

      e77cb0aa9a624cf66f83a8832af3b12dc9536a4ad24ed30bd194c7723bd3d6cb

    • SHA512

      d1fa9aa27d2209bc42967c0dd669d8f651bc8d7ba5285bd090536f7da9e320d73297a36ba2acf4e8da227f09e226c07348d9337357d0d2accedafa3fb3b179e2

    • SSDEEP

      49152:Y3gHkefQN3R/bq6ZqOO2zuH7k4gX1qw/B4qNby02RxFgBML+t9g1/ynPDWFQi9kb:sgHfINBlZqGzw7kFFKJgiLG98yPDG0

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks