Godfather: recovered C2 indicators & analysis

What Godfather is

Godfather (also stylized "GodFather") is an Android banking trojan first disclosed publicly by ThreatFabric in March 2022, with related activity traced back by Group-IB to June 2021. Group-IB's analysis identified it as a successor built on the source code of the Anubis banking trojan, whose code leaked on an underground forum in January 2019; the two share command-and-control command handling and web-fake (overlay) modules, though Godfather was modernized for newer Android versions and dropped some legacy Anubis features such as audio recording and location tracking. Godfather is distributed under a malware-as-a-service model to multiple operators, so the exact configuration and target set vary between campaigns.

In its established form, Godfather relies on Android's Accessibility Service to drive the infection: it logs keystrokes, captures screen content, and can perform automated on-screen actions. It presents HTML overlay screens ("web fakes") on top of, or in place of, targeted banking and cryptocurrency apps to harvest login credentials, and it intercepts SMS and push notifications to defeat one-time-password and two-factor authentication. Reported capabilities also include screen recording (the screen is recorded and the resulting file exfiltrated), call-log harvesting, a VNC-style remote-control module implemented with native libraries, and a SOCKS5 proxy for tunneling traffic through the infected device.

Later variants moved substantial logic into native code to reduce detection and, by 2024-2025, adopted an on-device app-virtualization technique. Documented by Cyble (November 2024) and analyzed in depth by Zimperium zLabs (June 2025), this approach embeds an open-source virtualization framework (such as VirtualApp) together with Xposed-style hooking inside the malicious host app. Instead of only drawing a fake overlay, the malware intercepts the launch intent for a targeted app via its accessibility permission, redirects the user to a copy of the real banking or crypto app running inside its controlled sandbox, and hooks the app's internals (for example the OkHttp client) to read credentials, PINs, tap events, and backend responses in real time while showing decoy screens. This provides a near-seamless experience and enables full account-takeover actions from inside the genuine app.

Godfather retrieves its command-and-control address using a dead-drop resolver: earlier samples decrypted the description of an actor-controlled Telegram channel (Blowfish-encoded), while later samples fetch a Base64-encoded C2 URL from a Telegram profile before communicating with the resolved server over HTTP(S); WebSocket connections have also been reported. Its target list has grown over time, from more than 400 banking and cryptocurrency apps across 16 countries reported by Group-IB in 2022 to roughly 484-500 banking, cryptocurrency, and e-commerce apps in 2024-2025 reporting, with observed geographic expansion into countries including Japan, Singapore, Greece, and Azerbaijan. The virtualization campaign analyzed by Zimperium was tightly focused on about a dozen Turkish financial institutions. Consistent with a Russian-speaking operator base, the malware halts execution when the device language is one of several CIS-region locales (RU, AZ, AM, BY, KZ, KG, MD, UZ, TJ).

Capabilities

• HTML overlay / web-fake screens to phish credentials from targeted banking and crypto apps
• Accessibility Service abuse for keylogging and automated on-screen control
• SMS interception and harvesting to bypass OTP/2FA
• Push and notification interception
• Call-log harvesting
• Screen recording and screenshot capture
• VNC-style remote device control (native implementation)
• SOCKS5 proxy on the infected device
• On-device app virtualization (VirtualApp + Xposed-style hooking) to run and instrument real banking apps in a sandbox
• In-app network traffic interception via OkHttp hooking (virtualization variant)
• Masquerades as legitimate apps (e.g., Google Play Protect, utility/converter apps) for distribution
• Malware-as-a-service targeting 400-500+ banking, crypto, and e-commerce apps worldwide
• Geofencing: disables itself on CIS-region device languages (RU, AZ, AM, BY, KZ, KG, MD, UZ, TJ)

Known C2 / channel types: HTTP(S), Telegram (dead-drop for C2 address via channel description / profile), WebSocket.

MITRE ATT&CK (Mobile)

Techniques commonly associated with Godfather:

What Privara Unmask recovered

Both samples used a Telegram channel as a dead-drop for their live C2 address. The channel URLs were recovered; the transport IP 149.154.167.99:443 is Telegram infrastructure, not a distinct C2, and is deliberately not listed as an indicator. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Godfather Android banking Trojan discovery
  Group-IB
• GodFather Malware Targets 500 Banking & Crypto Apps Worldwide
  Cyble (Cyble Research and Intelligence Labs)
• Your Mobile App, Their Playground: The Dark Side of Virtualization
  Zimperium zLabs
• Godfather Android malware now uses virtualization to hijack banking apps
  BleepingComputer
• GodFather Android Banking Trojan Targeting Users of Over 400 Banking and Crypto Apps
  The Hacker News

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.