golddigger | 8031c03fe33aafcba5e78ecead0af4e0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
8031c03fe33aafcba5e78ecead0af4e0.bin
Size 11.8MB
Sample241023-bt6y2athph
SHA256 8ad756b1de2e84f63a73947169687cf641714a6488c6682214f43589951a7364
MD5 bda6a1b709cb35d1008ff5ecf7487e75
SHA1 90244d791aa330a8cd36dfe4c04776ef06a52a80
SHA512 eab6833b6f78ebf16c14da36423d940d38b81313a5313870640d719dbca4ed1d34fa8b3c8567494d94e9bf3bc03678345316d449a9e572368a6c97b3d7a3ea75
SSDEEP 196608:gi7Wgua/w55xYwDIIxbPe6yOX/yIWyuh7vdwhqdqY6VKuOGpzCYi959h/8xWA:FChKgBQOX6+uhhIKQpzCLB/8xWA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

golddigger gigabud

Malware Config

Signatures

Gigabud family
gigabud

Gigabud payload 1 IoCs

resource	yara_rule
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_gigabud

GoldDigger payload 5 IoCs

resource	yara_rule
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_golddigger
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_golddigger
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_golddigger
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_golddigger
static1/unpack001/782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk	family_golddigger

Golddigger family
golddigger

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Requests dangerous framework permissions 19 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

8031c03fe33aafcba5e78ecead0af4e0.bin

.zip 11.8MB
782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk

.apk 13.3MB

8031c03fe33aafcba5e78ecead0af4e0.bin

SHA256 8ad756b1de2e84f63a73947169687cf641714a6488c6682214f43589951a7364
MD5 bda6a1b709cb35d1008ff5ecf7487e75
SHA1 90244d791aa330a8cd36dfe4c04776ef06a52a80
SHA512 eab6833b6f78ebf16c14da36423d940d38b81313a5313870640d719dbca4ed1d34fa8b3c8567494d94e9bf3bc03678345316d449a9e572368a6c97b3d7a3ea75
SSDEEP 196608:gi7Wgua/w55xYwDIIxbPe6yOX/yIWyuh7vdwhqdqY6VKuOGpzCYi959h/8xWA:FChKgBQOX6+uhhIKQpzCLB/8xWA
MD5 SHA1 SHA512 SSDEEP

Password

infected

782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40.apk

SHA256 782c6b2dad7cfc1f731c41653427e4d47f78a87f0ebc7041a8cc810204494c40
MD5 8031c03fe33aafcba5e78ecead0af4e0
SHA1 dc5b708c783f39c9b0af4962c7f4114207081321
SHA512 88dfe10ac77a9b975adf05c3c557cbbdbe99dd4ec256b8dd2ff7b75db2d1a389d5f8bd3820c193ce8d0f2bcd1f042a7b810ed8500b40761fac0184e269ca37b2
SSDEEP 393216:znjCKxXXhp97Y68kPIAlcFgGKCE7KmDOgg:zG8hP8kQA6SKmDOJ
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:arm64

Gigabud payload
GoldDigger payload

Password

infected

com.sextest.test

android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.RECORD_AUDIO android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.VIBRATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_EXTERNAL_STORAGE android.permission.GRANT_RUNTIME_PERMISSIONS android.permission.READ_SYNC_STATS android.permission.READ_SYNC_SETTINGS android.permission.READ_PRIVILEGED_PHONE_STATE android.permission.DISABLE_KEYGUARD android.permission.WAKE_LOCK android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.SYSTEM_ALERT_WINDOW android.permission.WRITE_SETTINGS android.permission.FOREGROUND_SERVICE android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.USE_FULL_SCREEN_INTENT android.permission.SET_WALLPAPER android.permission.CALL_PHONE android.permission.INTERNET android.permission.BATTERY_STATS android.permission.REORDER_TASKS android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_BACKGROUND_LOCATION android.permission.CAMERA android.permission.READ_CONTACTS android.permission.WRITE_CONTACTS android.permission.AUTHENTICATE_ACCOUNTS android.permission.GET_ACCOUNTS android.permission.WRITE_SYNC_SETTINGS android.permission.SCHEDULE_EXACT_ALARM android.permission.SYSTEM_OVERLAY_WINDOW android.permission.USE_EXACT_ALARM android.permission.FOREGROUND_SERVICE_DATA_SYNC android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.MANAGE_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE com.sextest.test.backtrace.warmed_up com.sextest.test.manual.dump com.sextest.test.matrix.permission.PROCESS_SUPERVISOR

com.djg.activity.RegisterFirst2Activity

com.djg.activity.RegisterSecond2Activity

com.djg.activity.LoginActivity

slwbduut.albmlfwj.rglpkmoo.ui.SplashActivity

android.intent.action.MAIN

slwbduut.albmlfwj.rglpkmoo.ui.LoginActivity

slwbduut.albmlfwj.rglpkmoo.ui.SettingInquirePwdActivity

slwbduut.albmlfwj.rglpkmoo.ui.WaitCheckActivity

slwbduut.albmlfwj.rglpkmoo.ui.SettingSafePwdActivity

slwbduut.albmlfwj.rglpkmoo.ui.ActivationActivity

slwbduut.albmlfwj.rglpkmoo.ui.CheckPermissionActivity

slwbduut.albmlfwj.rglpkmoo.ui.TransplentPermissionActivity

slwbduut.albmlfwj.rglpkmoo.ui.UploadIDPhotosActivity

slwbduut.albmlfwj.rglpkmoo.ui.FaceActivity

asd.fgh.thaw.TA

asd.fgh.thaw.BA

asd.fgh.component.AliasActivity

asd.fgh.component.GoogleActivity

asd.fgh.component.A0

asd.fgh.component.A1

asd.fgh.component.A2

asd.fgh.component.A3

asd.kkalive.com.daemon.activity.StrategyIDSAAAActivity

asd.kkalive.com.daemon.activity.OnePxActivity

android.settings.INPUT_METHOD_SETTINGS

asd.kkalive.com.daemon.activity.PowerAAAASSSSActivity

android.settings.INPUT_METHOD_SETTINGS

idkjkbqx.xoqoihjf.mediacodec.MainActivity

idkjkbqx.xoqoihjf.mediacodec.player.MediaCodecPlayerActivity

idkjkbqx.xoqoihjf.mediacodec.recorder.MediaCodecRecorderActivity

idkjkbqx.xoqoihjf.mediacodec.transcode.ui.MediaCodecTransCodeActivity

idkjkbqx.xoqoihjf.mediacodec.preview.video.PreviewVideoActivity

idkjkbqx.xoqoihjf.mediacodec.simple.MediaMuxerActivity

idkjkbqx.xoqoihjf.mediacodec.connect.ui.MediaCodecVideoConnectActivity

idkjkbqx.xoqoihjf.mediacodec.compose.ui.MediaCodecAudioComposeActivity

com.lxj.xpopup.util.XPermission$PermissionActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

slwbduut.albmlfwj.rglpkmoo.service.FocusService

android.accessibilityservice.AccessibilityService

slwbduut.albmlfwj.rglpkmoo.record.DisplayService

slwbduut.albmlfwj.rglpkmoo.record.CameraService

slwbduut.albmlfwj.rglpkmoo.record.AudioService

slwbduut.albmlfwj.rglpkmoo.record.LiveKitService

slwbduut.albmlfwj.rglpkmoo.service.RemoteService

com.action.myapp.need.switch

kixhukxt.lwgftwab.record.ScreenRecordService

com.fg.test.B

com.fg.remote

asd.fgh.provider.MR2Service

android.media.MediaRoute2ProviderService

asd.fgh.provider.TempForegroundService

android.media.MediaRoute2ProviderService

asd.fgh.provider.NewProcessService

android.media.MediaRoute2ProviderService

asd.fgh.component.JobService

asd.fgh.component.S0

asd.fgh.component.S1

asd.fgh.component.SnService

asd.fgh.account.AuthenticatorService

android.accounts.AccountAuthenticator

asd.fgh.account.SyncService

android.content.SyncAdapter

asd.fgh.wallpaper.LiveWallpaperService

android.service.wallpaper.WallpaperService

asd.fgh.workmanager.WmKeepService

androidx.work.impl.foreground.SystemForegroundService

asd.kkalive.com.daemon.services.DaemonJobService

asd.kkalive.com.daemon.services.ListenerJobService

asd.kkalive.com.daemon.services.PowerService

asd.kkalive.com.daemon.services.HandleService

asd.kkalive.com.daemon.services.DaemonService

asd.kkalive.com.daemon.sync.service.AuthService

android.accounts.AccountAuthenticator

asd.kkalive.com.daemon.sync.service.AuthService1

android.accounts.AccountAuthenticator

asd.kkalive.com.daemon.services.ScheduledService

asd.kkdaemon.component.RunService

com.sextest.test.monitor.bindService

asd.kkdaemon.component.AssistService1

asd.kkdaemon.notification.NotifyResidentService

asd.kkdaemon.core.SupportWorkerService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.room.MultiInstanceInvalidationService

com.tencent.matrix.backtrace.WarmUpService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.sextest.test.messenger

slwbduut.albmlfwj.rglpkmoo.ui.GlobalBroadcast

kixhukxt.lwgftwab.show.dialog kixhukxt.lwgftwab.close.dialog

asd.fgh.component.PackageReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_FULLY_REMOVED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_DATA_CLEARED android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_FIRST_LAUNCH android.intent.action.PACKAGE_NEEDS_VERIFICATION android.intent.action.PACKAGE_RESTARTED android.intent.action.PACKAGE_VERIFIED android.intent.action.PACKAGES_SUSPENDED android.intent.action.PACKAGES_UNSUSPENDED android.intent.action.MANAGE_PACKAGE_STORAGE android.intent.action.MY_PACKAGE_REPLACED android.intent.action.MY_PACKAGE_SUSPENDED android.intent.action.MY_PACKAGE_UNSUSPENDED

asd.fgh.component.SystemListenerReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_CLOCK android.intent.action.TIMEZONE_CHANGED android.intent.action.TIME_SET android.intent.action.MY_PACKAGE_REPLACED android.appwidget.action.APPWIDGET_UPDATE miui.appwidget.action.APPWIDGET_UPDATE