GodFather
Description
(Cyble) During our routine Open-Source Intelligence (OSINT) research, Cyble Research Labs came across a Twitter post wherein researchers mention an Android bankbot named GodFather with the name apkversion1.1.5.43 and an icon similar to the default Settings app.
We found notable similarities with Cereberus and Medusa banking trojans upon analyzing the malware sample. GodFather malware acts on the commands from Threat Actor’s (TA’s) Command & Control (C&C) server to steal sensitive information from the victim’s device.
Upon successful execution, the malware can perform malicious activities such as transferring money, getting device information such as phone number, installed app list, battery info, etc.
By further abusing the permissions on the affected device, the malware can also steal SMSs, control device screen using VNC, forward calls, and open URLs without the user’s knowledge.
Names
| Name |
|---|
| GodFather |
Category
Malware
Type
- Banking trojan
- Reconnaissance
- Info stealer
- Credential stealer
Information
- https://blog.cyble.com/2022/03/23/godfather-malware-under-the-lens/
- https://blog.cyble.com/2022/12/20/godfather-malware-returns-targeting-banking-users/
- https://www.darkreading.com/endpoint-security/godfather-banking-trojan-spawns-1k-samples-57-countries
- https://cyble.com/blog/godfather-malware-targets-500-banking-and-crypto-apps-worldwide/
Malpedia
Other Information
Uuid
922d749e-df19-477c-a88d-c0153df75733
Last Card Change
2024-12-26