godfather | 138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

Resubmissions

14/09/2026, 16:00

260914-tf2fhaeq3s10

14/09/2026, 10:57

11/04/2026, 07:54

09/02/2023, 14:11

01/02/2023, 07:33

Analysis

user interaction
yes
max time kernel
39s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
14/09/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.apk
Size 5.8MB
Sample260914-m2eqasbm4s
SHA256 138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4
MD5 c685ca051d3ca0cdee08f5a33a548031
SHA1 e2757e1edd96238202862ba5e7f926f5a3911e17
SHA512 fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527
SSDEEP 98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2
TLSH
T15256F042FB44AC7BC8F783324675163A563BCC658B43D287295C327C59B79DC4B8AAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion evasion godfather impact infostealer persistence stealth trojan

Malware Config

Signatures

Family: GodFather
GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.
banker trojan infostealer godfather

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4831	com.expressvpn.vpn

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.expressvpn.vpn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.expressvpn.vpn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.expressvpn.vpn

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.expressvpn.vpn

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.expressvpn.vpn

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.expressvpn.vpn
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.expressvpn.vpn
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.expressvpn.vpn
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.expressvpn.vpn

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.expressvpn.vpn

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.expressvpn.vpn

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.expressvpn.vpn

com.expressvpn.vpn
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4831