Extracted

• • Target

    6232b30398726350b704f677b2f5d5affa55dc04e0964f3e3dcdb3b41ea62c08.bin

  • Size

    4.8MB

  • MD5

    4f2da7f59fb05d5fd6f0cc60ceea644c

  • SHA1

    425a1002be3fd68c5178dc84200c101b1af1b34b

  • SHA256

    6232b30398726350b704f677b2f5d5affa55dc04e0964f3e3dcdb3b41ea62c08

  • SHA512

    b3a1a92d8de5d716ec7821a8165a41e8c6cb932c770e4b7da434946a12237fa069f0a24ce269def2024de644948f0baaf3a5fbbf543d13e488c4623f1fd80d4f

  • SSDEEP

    98304:ZlqBwojwhlJUORjOe2CspgFi6SW35zluCj55TBHUGNgMhZfkGGpO6LF:uglA1p96SWnukTB0GNgMshLF

  Score

  10^/10

  godfatherbankercollectioncredential_accessevasionimpactinfostealertrojan

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather

  • Godfather family

    godfather

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Acquires the wake lock

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3