 |
สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์ Electronic Transactions Development Agency |
|
สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์ Electronic Transactions Development Agency |
Tool: GodFather| Names | GodFather | |
| Category | Malware | |
| Type | Banking trojan, Reconnaissance, Info stealer, Credential stealer | |
| Description | (Cyble) During our routine Open-Source Intelligence (OSINT) research, Cyble Research Labs came across a Twitter post wherein researchers mention an Android bankbot named GodFather with the name apkversion1.1.5.43 and an icon similar to the default Settings app. We found notable similarities with Cereberus and Medusa banking trojans upon analyzing the malware sample. GodFather malware acts on the commands from Threat Actor’s (TA’s) Command & Control (C&C) server to steal sensitive information from the victim’s device. Upon successful execution, the malware can perform malicious activities such as transferring money, getting device information such as phone number, installed app list, battery info, etc. By further abusing the permissions on the affected device, the malware can also steal SMSs, control device screen using VNC, forward calls, and open URLs without the user’s knowledge. | |
| Information | <https://blog.cyble.com/2022/03/23/godfather-malware-under-the-lens/> <https://blog.cyble.com/2022/12/20/godfather-malware-returns-targeting-banking-users/> <https://www.darkreading.com/endpoint-security/godfather-banking-trojan-spawns-1k-samples-57-countries> | |
| Malpedia | <https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather> | |
Last change to this tool card: 18 June 2024
Download this tool card in JSON format
| Changed | Name | Country | Observed | ||
Unknown groups | |||||
 | _[ Interesting malware not linked to an actor yet ]_ | ||||
1 group listed (0 APT, 0 other, 1 unknown)
|
Digital Service Security Center Follow us on
|
Report incidents |
|
 |
+66 (0)2-123-1227 | |
 |
[email protected] | |