{
	"id": "395c565a-d06d-4ca4-82e8-90d0da35c7d2",
	"created_at": "2026-04-06T00:18:06.898377Z",
	"updated_at": "2026-04-10T03:20:36.059319Z",
	"deleted_at": null,
	"sha1_hash": "9e52d9fa95e0944895429453b2b8fffe276996a9",
	"title": "Godfather (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 40319,
	"plain_text": "Godfather (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 15:48:57 UTC\r\napk.godfather (Back to overview)\r\nGodfather\r\nAccording to PCrisk, Godfather is the name of an Android malware targeting online banking pages and\r\ncryptocurrency exchanges in 16 countries. It opens fake login windows over legitimate applications. Threat actors\r\nuse Godfather to steal account credentials. Additionally, Godfather can steal SMSs, device information, and other\r\ndata.\r\nReferences\r\n2025-08-29 ⋅ Shindan ⋅ Paul Viard\r\nGodFather - Part 1 - A multistage dropper\r\nGodfather\r\n2023-09-22 ⋅ Github (LaurieWired) ⋅ Laurie Kirk\r\nUnmasking the Godfather\r\nGodfather\r\n2023-08-17 ⋅ Brandefense ⋅ Brandefense\r\nGodfather Android Banking Trojan Technical Analysis\r\nGodfather\r\n2023-02-09 ⋅ Github (muha2xmad) ⋅ Muhammad Hasan Ali\r\nTechnical analysis of Godfather android malware\r\nGodfather\r\n2022-12-21 ⋅ Group-IB ⋅ Artem Grischenko\r\nGodfather: A banking Trojan that is impossible to refuse\r\nGodfather\r\nThere is no Yara-Signature yet.\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather\r\nPage 1 of 2\n\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather"
	],
	"report_names": [
		"apk.godfather"
	],
	"threat_actors": [],
	"ts_created_at": 1775434686,
	"ts_updated_at": 1775791236,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9e52d9fa95e0944895429453b2b8fffe276996a9.pdf",
		"text": "https://archive.orkl.eu/9e52d9fa95e0944895429453b2b8fffe276996a9.txt",
		"img": "https://archive.orkl.eu/9e52d9fa95e0944895429453b2b8fffe276996a9.jpg"
	}
}