Full Report
Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries
Analysis Summary
# Tool/Technique: Godfather (Android Banking Trojan)
## Overview
Godfather is a sophisticated Android banking Trojan designed to steal user credentials for banking applications, cryptocurrency wallets, and exchange accounts. It operates primarily through overlay attacks, where it displays a fraudulent login screen over a legitimate application to harvest sensitive information. It is considered a successor to the **Anubis** malware family, utilizing modernized code to bypass newer Android security features.
## Technical Details
- **Type:** Malware family (Banking Trojan)
- **Platform:** Android
- **Capabilities:** Overlay attacks (injects), SMS intercepting, Screen recording, Keylogging, C2 communication via Telegram, USSD execution.
- **First Seen:** Approximately June 2021 (initial versions), with a significant surge in activity identified in late 2022.
## MITRE ATT&CK Mapping
- **[TA0037 - Persistence]**
- T1624.001 - Event Notification Subscription (Accessibility Services)
- **[TA0030 - Privilege Escalation]**
- T1548 - Abuse Accessibility Services
- **[TA0031 - Credential Access]**
- T1411 - Input Capture (Keylogging)
- T1516 - Input Injection (Overlay Attacks)
- **[TA0032 - Discovery]**
- T1420 - File and Directory Discovery
- T1422 - System Network Configuration Discovery
- **[TA0041 - Command and Control]**
- T1102.002 - Web Service: Public Telegram Channels
## Functionality
### Core Capabilities
- **Overlay Attacks (Injections):** The malware generates HTML windows that mimic the login pages of over 400 targeted apps (banks, crypto wallets, and 2FA apps) to steal usernames and passwords.
- **SMS Interception:** Steals incoming SMS messages to bypass Two-Factor Authentication (2FA) codes.
- **Accessibility Service Abuse:** Requests permissions to the Android Accessibility Service to observe user actions, grant itself further permissions, and prevent manual uninstallation.
- **Data Exfiltration:** Collects device information including installed apps, SMS history, contacts, and account lists.
### Advanced Features
- **Telegram C2 Integration:** Uses encrypted/encoded messages within Telegram channel descriptions to dynamically retrieve its actual Command and Control (C2) server addresses.
- **Screen Recording & VNC:** Capabilities to record the device screen or establish a VNC connection for remote control.
- **Anti-Analysis:** Checks system language; the malware terminates if the device language is set to Russian, Azerbaijani, Armenian, Belarusian, Kazakh, Kyrgyz, Moldovan, Tajik, Turkmen, Uzbek, or Ukrainian (targeting users primarily outside the CIS region).
## Indicators of Compromise
- **File Hashes (SHA256):**
- `0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8`
- `7664293fc1dde797940d857d1f16eb1e12a15b9126d704854f97df1bedc18758`
- `9815ba07d0a2528c11d377b583243df24218a48c6a4f839f40769ea290555070`
- `c4bace10849f23e9972e555ac2e30ac128b7a90017a0f76c197685a0c60def6d`
- **Network Indicators:**
- `hXXps://t[.]me/dobrynyanikitichsobre`
- `hXXps://t[.]me/ropenetwork`
- `hXXps://henkormerise[.]com/`
- `hXXps://banerrokutepera[.]com/`
- `hXXp://168[.]100[.]9[.]86/`
- `hXXp://45[.]61[.]138[.]60/`
- **Behavioral Indicators:**
- Persistent requests for "Accessibility Services" permissions upon app launch.
- Unexpected appearance of login screens for banking or crypto apps when the app was not intentionally opened.
## Associated Threat Actors
- Currently attributed to unidentified Russian-speaking cybercriminals (based on the "Godfather" naming convention and the exclusion of CIS-based victims).
## Detection Methods
- **Signature-based:** Monitoring for the specific APK hashes listed above.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and immediately attempt to hide their icon or query the list of all installed packages.
- **Network Monitoring:** Alerting on outbound traffic to known Telegram C2 channels or the specific IP addresses/domains listed in the IOCs.
## Mitigation Strategies
- **User Education:** Caution users against downloading apps from unofficial sources or third-party websites.
- **Least Privilege:** Do not grant "Accessibility Service" permissions to apps that do not have a clear, legitimate need for them (e.g., a simple calculator or flashlight app).
- **MFA Hardening:** Use hardware security keys or authenticator apps (TOTP) rather than SMS-based 2FA where possible.
- **System Updates:** Ensure Android OS and security patches are up to date to mitigate exploit-based permission escalation.
## Related Tools/Techniques
- **Anubis:** The predecessor malware from which Godfather likely derived its codebase.
- **Medusa / TeaBot:** Similar Android banking Trojans using Accessibility Service abuse for overlay attacks.