Log in Request a demo

Godfather Android Banking Trojan Technical Analysis.

ReportMalware Analysis ReportsThreat Intelligence Researches

Published 11 Mar 2024Updated 17 Oct 2026

Secure digital data protection concept with glowing red digital network and cityscape background.

Godfather is an Android banking trojan. MITRE ATT&CK describes it as malware that uses virtualization to impersonate legitimate apps and abuses accessibility services to steal sensitive information. Since its discovery in 2020 it has targeted about 500 banking apps, cryptocurrency wallets and exchanges, with concentrated attacks on Turkish financial institutions. This page introduces the Brandefense technical report on the trojan.

What Will You Find in This Report on the Godfather Android Banking Trojan?

Learn Technical Method of Operation Details
The technical details of the Android Trojan and its abilities, infection methods, and more. The report will show many points about the trojan’s technical details, detections, and IoCs.

Gain Knowledge About Future Attacks
By understanding their attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.

Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic.

What Does the Godfather Report Cover?

The report is titled “Godfather Android Banking Trojan Technical Analysis”. It is 11 pages long, dated 11.08.2023, and numbered BD2023110801. It is marked TLP:CLEAN and written by the Threat Research Team.

What Are the Chapters?

  1. Executive Summary
  2. Technical Analysis, with three parts: Anti-Analysis Techniques, Application Runtime and Targeted Applications
  3. Conclusion
  4. IoC

What Does the Report Say About How Godfather Works?

  • It lists 11 Android permissions the malware needs. They include BIND_ACCESSIBILITY_SERVICE, QUERY_ALL_PACKAGES and POST_NOTIFICATIONS.
  • On launch it asks the user to turn on an accessibility service under the name “Müzik”. The report says it uses these rights to press buttons, read clicks, run apps and watch what is typed in a text field.
  • It decrypts strings at runtime with the Blowfish algorithm.
  • It reads its command and control address from an encrypted string in the description of a Telegram account. The report notes that other malware also uses this method.
  • It gets its list of target apps from the command and control server.
  • The report says it steals data by keylogging, not by an overlay attack as some other Android trojans do.

What Are the Targeted Apps and IoCs?

The Targeted Applications part lists Android package names of banking and payment apps, for example com.ziraat.ziraatmobil and com.garanti.cepsubesi. The IoC chapter gives one command and control address and seven package entries, each with MD5, SHA1 and SHA256 hashes.

What Does the Report Advise?

The conclusion says Godfather risks financial loss and personal privacy breach. It advises users to raise their cybersecurity awareness and download apps only from reputable sources. The report does not include a long mitigation chapter.

Who Is It for?

It suits analysts who need a short technical view of the trojan and teams that want hashes and package names to check against.

Questions

Frequently Asked Questions.

  • MITRE ATT&CK lists GodFather as Android banking malware that uses virtualization to impersonate legitimate applications and abuses accessibility services to steal sensitive information.

  • MITRE ATT&CK says it has targeted approximately 500 banking apps, cryptocurrency wallets and exchanges worldwide, with concentrated attacks on Turkish financial institutions.

  • MITRE ATT&CK says it used the accessibility service to prevent uninstallation, extract Google Authenticator one-time passwords and obtain user credentials.

  • The page says it covers technical details, infection methods, detections and IoCs, plus response and mitigation tactics.

  • The report says it steals information by keylogging instead of using an overlay attack.

  • The report says it reads an encrypted string from the description of a Telegram account, then decrypts it with Blowfish.

Where To Next.

Use Case Threat Actor Landscape See which groups matter for your sector. Open → Library Threat Library Groups, malware, techniques and incidents. Open → Module Dark Web Monitoring Watch the places where stolen data is traded. Open →

Research Is General. Your Exposure Is Not.

A demo of the platform, run on your own domain.

Request a demo