General

  • Target

    7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839.bin

  • Size

    4.6MB

  • Sample

    241218-12l19stnew

  • MD5

    31b75022ddef6eb2b06af50ae94fd257

  • SHA1

    d6f66a25fcbc04228bd256a51755bad2c5196f4f

  • SHA256

    7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839

  • SHA512

    ecaa5db022d1ef7f4583c4186a1c64a6aa61615092afcecd5383aa2d6880eb347d611b24dcf66a46b23cccad950941cf47e314cd5efdb6ab28c395a0bf00c73a

  • SSDEEP

    98304:VXsIOsIL8x+FD7Sy/gVr9V0zZE2lS87nwWfeFPjvqttu+IFP1:us2FD7/gVr9V0zZIxWfQ+tt3OP1

Malware Config

Extracted

Family

godfather

C2

https://t.me/raposekosaramuz

Targets

    • Target

      7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839.bin

    • Size

      4.6MB

    • MD5

      31b75022ddef6eb2b06af50ae94fd257

    • SHA1

      d6f66a25fcbc04228bd256a51755bad2c5196f4f

    • SHA256

      7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839

    • SHA512

      ecaa5db022d1ef7f4583c4186a1c64a6aa61615092afcecd5383aa2d6880eb347d611b24dcf66a46b23cccad950941cf47e314cd5efdb6ab28c395a0bf00c73a

    • SSDEEP

      98304:VXsIOsIL8x+FD7Sy/gVr9V0zZE2lS87nwWfeFPjvqttu+IFP1:us2FD7/gVr9V0zZIxWfQ+tt3OP1

    Score
    4/10
    • Target

      app.apk

    • Size

      3.9MB

    • MD5

      df43afa90abfe87b5164598b9ffa03e7

    • SHA1

      b5f3a4d5c492555bed4007ada9c94419f68959a8

    • SHA256

      c30e1764bcdd4eda8915d1081f826b6f14e9668160e5d8f83b85dab3425a112a

    • SHA512

      efa57bca8852b25c15d49517cabf460d5ddd83d14450ae737d33f25c6ffd98b59e98f2e2b91868be2a3563afc7fe5491e061ace55a4031b4bdeb62d35694bd66

    • SSDEEP

      98304:XWXaQLUzSCA5gJjVABxaipkRPVYWxFWhnBdxHaZT:XWXJLUzigJjVABxKsWxU3d0ZT

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

MITRE ATT&CK Mobile v15

Tasks