GodFather
GodFather is a malware family that is active in the Infostealer category and is widely observed around the world. This example is classified as an infostealer that harvests sensitive credentials and personal data on affected systems. Browser saved passwords, cookies, cryptocurrency wallet data and session tokens are infected with this malware.
History
GodFather, 2021 yilinda ortaya cikan ve The Godfather filmininden ilham alinan Android bankacilik trojanidır. 400+ finans uygulamasini taklit eden overlay saldirisi ile kullanicilarin kimlik bilgilerini calabilmektedir. 2022'de Rusca kaynak kodunun yayilmasıyla birden fazla varyant ortaya cikmistir. Turkey, UK, US ve Avrupa bankacilik uygulamalarina karsi aktif kampanyalarda gorulmustur.
Technical Details
Infostealer ailesi: TCP C2 protokolu, kalicilik mekanizmasi (Registry/Task Scheduler), keylogger, ekran goruntüsü, uzak kabuk, dosya yoneticisi, process manager, anti-analiz kontrolleri
Threat Profile
Type
Infostealer
Programming LanguageJava
C2 ProtocolHTTP
First Seen2020
Targets
Windows
Purpose / Capabilities
- Browser Credentials
- Cookie Theft
- Crypto Wallet
- 2FA Code
No C2 servers have been identified for this family yet.