GodFather

This malware often spreads through fake applications or malicious websites. It increases infection risks by luring users into traps with deceptive content.

The malware will send message which contains malicous URLs to download malicous applications to victim’s contacts. This message is received from the C2 server and then the malware will send it to all contacts.

This fake interface serves as a social engineering lure... Subsequently, the malware issues an intent requesting the MANAGE_UNKNOWN_APP_SOURCES permission... prompting the user to allow installations from unknown sources specifically for this app.

The initial stage acts as a loader or stub, whose main purpose is to dynamically load the actual dropper code at runtime... These .dex files represent the second stage of the dropper payload dynamically loaded in memory.

Upon execution, the malware requests activation of its accessibility service under the name of “Müzik”. It is observed that the malware uses accessibility rights to press buttons on the screen, read user inputs such as user clicks, run applications, and monitor what users have typed in a certain text field.

Upon execution, the malware requests activation of its accessibility service under the name of “Müzik”. It is observed that the malware uses accessibility rights to press buttons on the screen, read user inputs such as user clicks, run applications, and monitor what users have typed in a certain text field.

The second stage of the dropper bypasses the Restricted Settings feature added by Google on Android 13... prompting the user to allow installations from unknown sources specifically for this app... Once active, the core program immediately requests Accessibility Service privileges, enabling it to bypass user interaction barriers.

The malware uses the encrypted strings at runtime by decrypting them using the blowfish algorithm.

Upon execution, the malware requests activation of its accessibility service under the name of “Müzik”.

Each file is passed to the decryptFile() function, which handles two key operations: decompression and decryption... Step 1: Decompression (DEFLATE Algorithm)... Step 2: DES Decryption... This decryption step transforms the compressed and encrypted payloads into valid, readable DEX files.

When the user interacts with the AlertDialog... the dropper initiates a new app installation process via the Android PackageInstaller API... session.commit(...).

After installing The malware on the device, it checks the device if it’s an emulator or not. If the malware is installed on the emulator, the malware will not run its malicious functions.

The initial stage acts as a loader or stub, whose main purpose is to dynamically load the actual dropper code at runtime... These .dex files represent the second stage of the dropper payload dynamically loaded in memory.

When the user opens a targeted app, the malware displays a fake or malicious overlay on top of the active window of the targeted app. The opened malicious window is the same as the legitimate app. This allows the attacker to steal sensitive information, such as login credentials, credit card numbers, or other sensitive data, by tricking the user into entering it into the overlay.

Utilizing keylogging, Godfather monitors users’ keystrokes, steals entered data, and tracks user interactions.

“Session cookie theft ... increased in 2025.”

The ultimate goal, ThreatFabric said, is to trigger the "automatic initiation of fraudulent transactions and its authorization without manual efforts from the operator..."

Leaking push notifications and SMS messages (to bypass 2FA)

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

After installing The malware on the device, it checks the device if it’s an emulator or not. If the malware is installed on the emulator, the malware will not run its malicious functions.

QUERY_ALL_PACKAGES gives the app visibility into all installed packages on the device... if ( ! isAppInstalled ( "com.heb.reb" ) ) { showDialog ( ) ; return ; }

The malware will collect information about the device that’s infected and send the collected information to the C2 server . The information which will be sent to the C2 server such as applist which will collect all the applications installed on the device, ag to get the user agent, sim to get the network operator name, phone to get the phone number of the device, model , and ver of the device.

Some activities that Godfather trojan software performs on infected systems; Creating VNC connections

“Godfather and Teabot malware families ... focus on device takeover and session manipulation to bypass strong authentication controls.”

When the user opens a targeted app, the malware displays a fake or malicious overlay on top of the active window of the targeted app. The opened malicious window is the same as the legitimate app. This allows the attacker to steal sensitive information, such as login credentials, credit card numbers, or other sensitive data, by tricking the user into entering it into the overlay.

Utilizing keylogging, Godfather monitors users’ keystrokes, steals entered data, and tracks user interactions.

Some activities that Godfather trojan software performs on infected systems; Recording the device’s screen

The malware opens a file named bhgdtczzkbjacwee from the assets folder... The file bhgdtczzkbjacwee is actually a .zip archive containing two DEX files: classes2.dex and classes.dex.

Godfather can transmit captured data to a command and control server. | Establishing WebSocket connections

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

Start proxy servers

The malware may also use the VNC connection to install additional malicious software on the device, making it part of a larger network of compromised devices

VNC can be used by the malware to gain remote control over an infected device, allowing the attacker to perform various malicious activities.

It gets the command control address with the encrypted string in the description of a telegram account.

After the malware gets the C2 server the communication between the C2 server and the malware will be decrypted using AES/CBC/NoPadding with fedcba9876543210 as IV and 0123456789abcdef as a key.

The malware will collect information about the device that’s infected and send the collected information to the C2 server .