Extracted

• • Target
    3.apk
  • Size 5.8MB
  • SHA256 138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4
  • MD5 c685ca051d3ca0cdee08f5a33a548031
  • SHA1 e2757e1edd96238202862ba5e7f926f5a3911e17
  • SHA512 fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527
  • SSDEEP 98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2
  • TLSH
    T15256F042FB44AC7BC8F783324675163A563BCC658B43D287295C327C59B79DC4B8AAC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionevasiongodfatherimpactinfostealerpersistencestealthtrojan

  • Family: GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2