Unmasking the Godfather - Reverse Engineering the Latest Android Banking Trojan
summary
Reverse engineering shows the Godfather Android banking Trojan (derived from Anubis, sample from 2021) actually hides readable Java via obfuscation and encoded strings, refuses to run under x86 emulators via an is emulator check, and escalates privileges by spamming for accessibility services to scrape screens. Static decompilation and dynamic hooking reveal fake HTML overlays over targeted banking apps, screen recording and native VNC, encrypted C2 exfiltration to steal credentials from 400+ institutions and even remote-phone actions.
AI-written summary · about
chapters (16)
- 0:00Android banking Trojans intro
- 1:30Evolution of banking Trojans
- 3:39The Godfather origins and variants
- 5:45Static analysis of APK
- 8:13Decompiling with JADX
- 12:05Obfuscated code analysis
- 16:41Decoding obfuscated strings
- 18:26Bypassing anti-emulation
- 22:39Frida demo against detection
- 26:16Why accessibility services
- 28:43Accessibility module analysis
- 32:35Password/PIN parsing
- 35:46Variant capabilities
- 36:27Obfuscation and evasion summary
- 38:11Banking Trojan capabilities
- 39:23Q&A
related talks
57m(In)Security of Mobile Banking
32mHacking the Hackers’ Code: Inside Android Malware
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
29mA Day in the Life of a Mobile Malware Reverse Engineer
53mAndroid: He protec, but he also attac
33mShielding Your Android App from Attackers
43mAttacking Android Applications
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs