GodfatherMalware
According to PCrisk, Godfather is the name of an Android malware targeting online banking pages and cryptocurrency exchanges in 16 countries. It opens fake login windows over legitimate applications. Threat actors use Godfather to steal account credentials. Additionally, Godfather can steal SMSs, device information, and other data.From MISP Galaxy
Last reported 3 years ago, by Group-IB3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“… as well as knowing that the event was triggered by package “com.windscribe.vpn”, it is highly likely that the malicious software was masquerading itself as “windscribe vpn” application when the affected user possibly downloaded it.”
- T1056.001Keylogging
“This means it can see the victim’s balance, harvest the second credential issued for two-factor authentication, and implement keylogging functions, allowing it to capture credentials.”
- T1684Social Engineering
“… cybercriminals are constantly improving their methods to appear more credible to potential victims, making it hard to recognize a social engineering attempt.”
What the reports say
3 reports, newest first · the exact sentence from each-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“…alware families currently targeting the region include the Gigabud family, SpyNote, HookBot, PWNDROID4, CraxsRAT, TgToxic, and Anubis (Godfather’s predecessor), etc.”
-
Bad Behaviour: How to detect banking trojans“A few months ago, the Group-IB Threat Intelligence team detected the activity of a mobile Android trojan – Godfather.”
-
Godfather Trojan – mobile banking malware that is impossible to refuse“Godfather Trojan – mobile banking malware that is impossible to refuse”
Indicators in its reports
named in the reports above- www.threatfabric[.]comin 1 report
- ks8cb[.]ccin 1 report
- ms2ve[.]ccin 1 report
- zu7kt[.]ccin 1 report
- d8834a21bc70fbe2…e35be1b7276bin 1 report
- hds6y[.]ccin 1 report
- smgeo[.]ccin 1 report
- www.dg1e[.]comin 1 report
- wbke[.]ccin 1 report
- c2b91a1d4b3d1dff…7320709230a1in 1 report
- 139a5bcc92044e2e…abac6a1634bcin 1 report
- 569626b0b6ef277c…ac492fb4e6a7in 1 report
- 6171db5548941aff…9b72fcffbb60in 1 report
- 0ffd769fec531474…972dd82414f5in 1 report
- 6a8c601ba5a0eaeb…11bd07457407in 1 report
- 43d058aacb210c33…9e233b3f1cd4in 1 report
- 03b30ad69bd7c4ef…db6b46fb6164in 1 report
- b80a297daeb4ae11…5ceeff53267cin 1 report
- 380abc14ee41ad14…8d8f86287427in 1 report
- 5827a6e0251a095b…e9f48fe61ff1in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.