General

  • Target

    d813b0e354f510af79982f302a9ef6786b033a7cd50ffabcd12b59a5da893a58.bin

  • Size

    4.6MB

  • MD5

    f7a39f11e8ba1326a0a5fc5ccbc882d0

  • SHA1

    48b509113b102f9af64f5972736109f04c6157cf

  • SHA256

    d813b0e354f510af79982f302a9ef6786b033a7cd50ffabcd12b59a5da893a58

  • SHA512

    dfbdd335d60875f9840aca53515a8686c876900e6be0a8922a3aacafb692c10ef9bc4ad3ef4a5d852fef32fcfcb1cbd4ee4736f831066ef73e05ae793342a945

  • SSDEEP

    98304:PZgIeh5pe1N1gRHlsDuxAgDF5yR1nsRIGwk+9UR75iDyqVm9Ysn:PCIK5EH1VSxLBAPKuo7UD4YE

Score
10/10

Malware Config

Extracted

Family

godfather

C2

https://t.me/raposekosaramuz

Signatures

  • Godfather family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 1 IoCs

Files

  • d813b0e354f510af79982f302a9ef6786b033a7cd50ffabcd12b59a5da893a58.bin
    .apk android

    com.gimme.guardants

    com.gimme.guardants.cahuy


  • app.apk
    .apk android

    com.carnaptious.rudistid

    com.carnaptious.rudistid.amiced


Android Permissions

d813b0e354f510af79982f302a9ef6786b033a7cd50ffabcd12b59a5da893a58.bin

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES