Overview

overview

10

Static

static

6

6232b30398...08.apk

android-9-x86

10

6232b30398...08.apk

android-10-x64

10

6232b30398...08.apk

android-11-x64

10

Resubmissions

09-11-2024 01:33

241109-byrd5svald 10

08-11-2024 23:23

241108-3dg4hsscnn 10

Analysis

  • max time kernel
    132s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    09-11-2024 01:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6232b30398726350b704f677b2f5d5affa55dc04e0964f3e3dcdb3b41ea62c08.apk

  • Size

    4.8MB

  • MD5

    4f2da7f59fb05d5fd6f0cc60ceea644c

  • SHA1

    425a1002be3fd68c5178dc84200c101b1af1b34b

  • SHA256

    6232b30398726350b704f677b2f5d5affa55dc04e0964f3e3dcdb3b41ea62c08

  • SHA512

    b3a1a92d8de5d716ec7821a8165a41e8c6cb932c770e4b7da434946a12237fa069f0a24ce269def2024de644948f0baaf3a5fbbf543d13e488c4623f1fd80d4f

  • SSDEEP

    98304:ZlqBwojwhlJUORjOe2CspgFi6SW35zluCj55TBHUGNgMhZfkGGpO6LF:uglA1p96SWnukTB0GNgMshLF

Score
10/10
godfatherbankerevasionimpactinfostealertrojan

Malware Config

Extracted

Family

godfather

C2

https://t.me/fakapaparamokas

Signatures

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather
  • Godfather family
    godfather
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.prizeable.ldx
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5054

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.prizeable.ldx/app_mesh/foB.json
    Filesize

    2.3MB

    MD5

    f7a50e10acc10cf7bf0c2b99699da83f

    SHA1

    aab764adcf304414841132bdea32628c48fa8fb5

    SHA256

    703f78d35240b846caac0a3c3a40043035846f13ae772c4974a02adc6d5a4f5c

    SHA512

    e75da50d462b99e697687a0e01612fc256bc2f089084c07cc4317f6eab42822b7366d64d51c5ec5b40248a61624cd5e8853d9d4a35134b097fc2448288354c21

    Download Submit

  • /data/data/com.prizeable.ldx/app_mesh/foB.json
    Filesize

    2.3MB

    MD5

    5c92094bb2fcef05fe149f72fc2cd929

    SHA1

    a54b1fff30626901d9df1fd74058d20159b41b88

    SHA256

    864726f4967bd573f017264a694b9017e7ef06b25e0392fdf9cb678f6a784942

    SHA512

    373e48ffaa442b757492ff6efcf8a07cfe2098852eab216dea9222dcf654107dae624138ec4932394fb7baba055057112b93be5bbed9c1a7c71ebb72204d62a8

    Download Submit

  • /data/data/com.prizeable.ldx/app_mesh/oat/foB.json.cur.prof
    Filesize

    4KB

    MD5

    6a14a07bc520c45f2e73ea56ea2fb2d5

    SHA1

    78a5b1dfad62d0d1efaec946d7c45f99d68278d3

    SHA256

    530641451023b27d501dbf2ad97909a78a544a0f13b8fe0466a17c7e09109ec9

    SHA512

    3d4753b44b675359bbbbcbba968d9a8193e156ca1cfc58832340fec4636d64e4d83d5316719d2fe606500140f1c08f10690b8209a77f47784acb8e574622593f

    Download Submit

  • /data/user/0/com.prizeable.ldx/app_mesh/foB.json
    Filesize

    6.2MB

    MD5

    1388e4ae7ae7231f3a90acdbbd2d9a5d

    SHA1

    9006c44d06d5b875659e934e7d5cb1fb17b17464

    SHA256

    c7e6ae1df6cbc565d7e642481e8cfb4ae0c44f86265a45deacf9c62914c59825

    SHA512

    5c55b770380b1aeb5a939afaa9cf88dc7e890f6e11735f78a3b99a14357929b5867fc0595692c5c1da0d6ae3620110326a7089b54f55f2a59f1102d95537b63a

    Download Submit