MalwarePublished 10 Jan 2023

OSINT · Godfather Trojan IOCs

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Godfather Trojan IOCs

Impact

For European organizations, the Godfather Trojan poses a substantial risk primarily through the compromise of mobile devices, which are widely used for corporate communications, access to sensitive data, and multi-factor authentication. The Trojan's delivery via authorized app stores increases the likelihood of infection, as users may inadvertently install compromised apps believing them to be legitimate. Data exfiltration over C2 channels threatens confidentiality, potentially leading to leakage of intellectual property, personal data, or credentials. This can result in financial losses, reputational damage, and regulatory penalties under GDPR. The Trojan's stealthy nature complicates detection and response, increasing dwell time and the potential scope of compromise. Sectors such as finance, government, and critical infrastructure are particularly vulnerable due to the value of the data and the strategic importance of mobile communications. The absence of patches means organizations must rely on detection and prevention rather than remediation, increasing operational risk.

Defensive guidance

To mitigate the Godfather Trojan threat, European organizations should implement a multi-layered mobile security strategy. First, enforce strict mobile application management policies that restrict installation to vetted apps and utilize enterprise app stores or mobile threat defense solutions to scan apps for malicious behavior before deployment. Second, enhance network monitoring to detect anomalous outbound traffic indicative of C2 communications, employing behavioral analytics and threat intelligence feeds to identify suspicious patterns. Third, educate users on the risks of installing apps from unauthorized sources and encourage vigilance even with apps from official stores. Fourth, deploy endpoint detection and response (EDR) tools capable of monitoring mobile devices for unusual activities and potential indicators of compromise. Fifth, implement strong access controls and multi-factor authentication to limit the impact of credential theft. Finally, collaborate with app store providers and cybersecurity communities to share intelligence and rapidly respond to emerging threats. Regular audits of mobile device security posture and incident response readiness are also critical.

Indicators of compromise

Domains 4

henkormerise.com
banerrokutepera.com
heikenmorgan.com
pluscurrencyconverter.com

URLs 8

http://168.100.9.86/
http://45.61.138.60/
http://50.18.3.26/
http://heikenmorgan.com/
https://banerrokutepera.com/
https://henkormerise.com/
heikenmorgan.com
banerrokutepera.com

IP addresses 3

168.100.9.86
45.61.138.60
50.18.3.26

Hashes 14

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
38386f4fabd0bc7f7065eaee818717e89772fb3b1a3744df754c45778e353f70
7664293fc1dde797940d857d1f16eb1e12a15b9126d704854f97df1bedc18758
9815ba07d0a2528c11d377b583243df24218a48c6a4f839f40769ea290555070
9dfb5b4ad9aac36c2d7fbb93f8668faa819cb0df16f4a55d00f1cdda89c9a6d2
a14aad1265eb307fbe71a3a5f6e688408ce153ff19838b3c5229f26ee3ece5dd
b6249fa996cb4046bdab37bab5e3b4d43c79ea537f119040c3b3e138149897fd
c3dadb9a593523d1bf3fe76dabf375578119aff3110d92a1a4ee6db06742263a
c4bace10849f23e9972e555ac2e30ac128b7a90017a0f76c197685a0c60def6d
c79857015dbf220111e7c5f47cf20a656741a9380cc0faecd486b517648eb199

User agent 1

%KEY% is the key sent as a parameter in the requests mentioned above. %LOCALE% is the system language. The user-agent used when the request is executed is:

Mozilla/5.0 (Linux; Android 9; SM-J730F Build/PPR12.180610.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36

Link 4

https://1275.ru/ioc/1192/godfather-trojan-iocs/
https://www.virustotal.com/gui/file/0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
https://www.virustotal.com/gui/file/9815ba07d0a2528c11d377b583243df24218a48c6a4f839f40769ea290555070
https://blog.group-ib.com/godfather-trojan

Text 6

Group-IB обнаружили в официальном магазине Google Play банковского трояна Godfather, где вредонос маскируется под легальные криптоприложения. География его жертв охватывает 16 стран мира, а список целей насчитывает более 400 различных банков, криптовалютных бирж и электронных кошельков.
Blog
29/66
22/66
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other financial services, and drain the accounts. To date, its victims include users of over 400 international targets, including banking applications, cryptocurrency wallets, and crypto exchanges. Few people realize that hiding under Godfather’s hood is an old banking Trojan called Anubis, whose functionality has become outdated due to Android updates and the efforts of malware detection and prevention providers.
Blog

Tlsh 1

t1cb76125af718a86fc1f792324679522a66074c268743ea875968727c0dbbdc04f4bfcc

Vhash 1

ede26ab6fd89266ae46ad188b676ce54

Ssdeep 1

98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR

Community reviews

Loading reviews…