Log in Request a demo

Godfather Android Banking Trojan Technical Analysis

Godfather is an Android banking trojan that logs keystrokes and abuses accessibility rights to steal financial data. See the analysis and its C2 method.

Brandefense logo Updated 5 Min Read
Illustration of puppet strings symbolizing Godfather trojan cyber threats in the financial sector

Godfather is an Android banking trojan that steals financial and personal information. It records keystrokes, abuses the accessibility service and sends captured data to a command and control server. It spreads through fake applications and malicious websites, and the activity described here targeted banking and cryptocurrency apps, especially in Turkey.

This is the open version of Godfather Android Banking Trojan Technical Analysis. If you want to download it as a PDF click here.

What Is the Godfather Android Banking Trojan?

Godfather stands out among malicious Android software as a significant threat. This malware targets financial and personal information, endangering users’ security. Key characteristics of Godfather include:

  • Objective and Threat: Godfather aims to seize users’ financial account information, identity data, and personal details. It can jeopardize users’ security, leading to financial losses and identity theft.
  • Operational Mechanism: Utilizing keylogging, Godfather monitors users’ keystrokes, steals entered data, and tracks user interactions.
  • Distribution Methods: This malware often spreads through fake applications or malicious websites. It increases infection risks by luring users into traps with deceptive content.
  • Data Transmission: Godfather can transmit captured data to a command and control server.

Before the Analysis

Godfather Trojan Activity Targeting Financial Sector Detected

MITRE ATT&CK describes the Godfather Android banking trojan as malware first identified in 2020 that targets banking applications, cryptocurrency wallets and exchanges, with its virtualization-based attacks focused primarily on Turkish financial institutions. [Read More]

godfather trojan fake web pages imitating mobile banking applications in Turkey
Figure 1: Fake Web Pages Imitating Mobile Banking Applications Serving in Turkey

Some activities that Godfather trojan software performs on infected systems;

  • Recording the device’s screen
  • Creating VNC connections
  • Capturing keystrokes (keylogging)
  • Leaking push notifications and SMS messages (to bypass 2FA)
  • Send SMS messages
  • Forward calls
  • Execute USSD requests
  • Start proxy servers
  • Enabling silent mode
  • Establishing WebSocket connections

Godfather Trojan activities have been seen again, especially in Turkey. This time, attackers mainly have used music apps to infect the victims of the android trojan, Godfather.

infected music apps by godfather android trojan
Image Source: twitter.com/0x6rss

Technical Analysis

Godfather malware requires the following permissions.

Permission List

  • android.permission.ACCESS_NETWORK_STATE
  • android.permission.ACCESS_WIFI_STATE
  • android.permission.BIND_ACCESSIBILITY_SERVICE
  • android.permission.FOREGROUND_SERVICE
  • android.permission.INTERNET
  • android.permission.POST_NOTIFICATIONS
  • android.permission.QUERY_ALL_PACKAGES
  • android.permission.READ_PHONE_STATE
  • android.permission.READ_PRIVILEGED_PHONE_STATE
  • android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
  • android.permission.WAKE_LOCK

With the permissions given above, the malware in question is able to perform the following actions:

  • Internet access
  • Ability to use Accessibility service
  • Installing application
  • Access notifications
  • Running as a foreground service

Upon execution, the malware requests activation of its accessibility service under the name of “Müzik”. It is observed that the malware uses accessibility rights to press buttons on the screen, read user inputs such as user clicks, run applications, and monitor what users have typed in a certain text field.

godfather accesibility server
Figure 2: Accessibility service request

How Does Godfather Avoid Analysis?

The malware uses the encrypted strings at runtime by decrypting them using the blowfish algorithm.(secret key: 67d45d2f64)

godfather android trojan accessibility request
Figure 3: Accessibility service request

It gets the command control address with the encrypted string in the description of a telegram account. This method is also often used by other malware.

godfather telegram decription
Figure 4: Telegram Description

Again, it uses blowfish to decrypt this encrypted string. (key:ABC, IV:abcdefgh)

extracted malware payload in stealc malware
Figure 5: Jump to the extracted malware payload

Application Runtime

Godfather malware retrieves the list of target applications from the command and control server.

targeted apps by godfather android trojan
Figure 6: Targeted Apps

Unlike other malware (eg, cerberus, hook, ermac), the analyzed sample steals information by keylogging instead of using an overlay attack. MITRE ATT&CK notes that Godfather has also used overlay attacks in other cases (MITRE ATT&CK S1231).

godfather's keylogger feature
Figure 7: Keylogger
godfather keylogger logs
Figure 8: Keylogger output
How Godfather works on a device
  1. Fake app installedSpreads through fake applications or malicious websites
  2. Accessibility requestAsks to activate its accessibility service under the name Müzik
  3. C2 address foundDecrypts it from the description of a Telegram account using Blowfish
  4. Target list fetchedRetrieves the list of target applications from the command and control server
  5. Keystrokes stolenLogs what the user types in the targeted appsTechnique T1417.001 (MITRE ATT&CK, opens in a new tab)

Which Apps Does Godfather Target?

  • com[.]tmobtech.halkbank
  • com[.]vakifbank.mobile
  • com[.]ziraat.ziraatmobil
  • com[.]akbank.android.apps.akbankdirekt
  • com[.]anadolubank.android
  • com[.]fibabanka.Fibabanka.mobile
  • tr.com[.]sekerbilisim.mbank
  • com[.]teb
  • com[.]teb.kurumsal
  • com[.]pozitron.iscep
  • com[.]ykb.android
  • tr[.]com[.]abank.dijital
  • com[.]a2a.android.burgan
  • com[.]denizbank.mobildeniz
  • com[.]garanti.cepsubesi
  • com[.]ingbanktr.ingmobil
  • com[.]magiclick.odeabank
  • com[.]finansbank.mobile.cepsube
  • finansbank[.]enpara
  • finansbank[.]enpara.sirketim
  • com[.]kuveytturk.mobil
  • com[.]ziraatkatilim.mobilebanking
  • com[.]tfkb
  • com[.]albarakaapp
  • com[.]aktifbank.nkolay
  • com[.]fibabanka.mobile
  • com[.]ininal.wallet
  • com[.]intertech.mobilemoneytransfer.activity
  • com[.]isbank.isyerim
  • com[.]kuveytturk.yourbank
  • com[.]mobillium.papara
  • com[.]pttfinans
  • com[.]turkcell.paycell
  • com[.]vakifkatilim.mobil
  • paladyum[.]peppara
  • tr.com[.]hsbc.hsbcturkey.uk
  • tr.com[.]param.android

Conclusion

Godfather represents a serious instance of malicious software, carrying risks like financial loss and personal privacy breaches. Users need to enhance their cybersecurity awareness and download from reputable sources.

You can find the IoCs on our GitHub repo.

Frequently Asked Questions.

What is the Godfather Android banking trojan?

Godfather is a malicious Android app that targets financial and personal information. It can record the screen, log keystrokes, leak SMS and push notifications to get around 2FA, and send captured data to a command and control server.

How does Godfather steal banking credentials?

The post says the analyzed sample steals information by keylogging through Android accessibility rights, instead of using an overlay attack. MITRE ATT&CK notes Godfather has also used overlay attacks in other cases, and describes Android keylogging as abuse of an AccessibilityService class that listens for text-change events.

How does Godfather get infected onto phones?

The post says it often spreads through fake applications or malicious websites. In the recent Turkish activity described, attackers mainly used music apps to infect victims.

How does Godfather find its command and control server?

It reads an encrypted string placed in the description of a Telegram account and decrypts it with the Blowfish algorithm. The post notes other malware also uses this method.

Sources

  1. 1 MITRE ATT&CK: GodFather (S1231)
  2. 2 MITRE ATT&CK: Input Capture, Keylogging (T1417.001)
  3. 3 MITRE ATT&CK: Input Capture (T1417)
Share

In This Article

TermsTrojan TermsCommand and control (C2) TermsMalware

Where To Next.

All Articles
In plain words · Glossary term Trojan

A Trojan is a program that appears to have a useful function but also has a hidden, potentially malicious function.

Open → Keep reading · Article DNS Under Siege: Analysis of Threat Actor-Driven Abuse

Learn how DNS works and how threat actors abuse it through DNS tunneling and fast-flux networks, plus why DNS monitoring and threat intelligence matter.

Open → Keep reading · Article Stealc Malware Technical Analysis Report

Stealc technical analysis: how this infostealer is packed, how it avoids analysis, talks to its command server and which browsers and wallets it targets.

Open →

Knowledge HubMalware and tools