golddigger | Identitas Kependudukan Digital[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
Identitas Kependudukan Digital.apk
Size 17.4MB
Sample250717-e7mzvsvtev
SHA256 c3d528b3cf8def7285977649e228dcf01847ce4f1432140cfa9a8067fd302ddb
MD5 c24f29b1a3fd5513f8c87943c8178912
SHA1 9823bfbfe91ed1a8225e185e2767c7d378e8f66e
SHA512 87ad25ea8ba0d9c50f2f30ed3b5d4fc36d9395b366a620c4f69ea0f8499a15dacb398a4799b538f92d0539c3b51d92e739e8f63dbd5005ecb0dd11b35b8318dc
SSDEEP 393216:R1gnikhxXz4RNGx/i/OjVUxzVTHJc7YK9y+gHsxD3:R18QGxaGjiVLJcn9yDsx7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

golddigger

Malware Config

Signatures

GoldDigger payload 2 IoCs

resource	yara_rule
sample	family_golddigger
sample	family_golddigger

Golddigger family
golddigger
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

Identitas Kependudukan Digital.apk

.apk 17.4MB

Identitas Kependudukan Digital.apk

SHA256 c3d528b3cf8def7285977649e228dcf01847ce4f1432140cfa9a8067fd302ddb
MD5 c24f29b1a3fd5513f8c87943c8178912
SHA1 9823bfbfe91ed1a8225e185e2767c7d378e8f66e
SHA512 87ad25ea8ba0d9c50f2f30ed3b5d4fc36d9395b366a620c4f69ea0f8499a15dacb398a4799b538f92d0539c3b51d92e739e8f63dbd5005ecb0dd11b35b8318dc
SSDEEP 393216:R1gnikhxXz4RNGx/i/OjVUxzVTHJc7YK9y+gHsxD3:R18QGxaGjiVLJcn9yDsx7
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm

GoldDigger payload

com.zam.tquroa

ngodanao.fdsnofdno.fdsfnso.RegisterFirst2Activity

ngodanao.fdsnofdno.fdsfnso.LoginActivity

net.tents.dedrf.ui.SplashActivity

android.intent.action.MAIN

net.tents.dedrf.ui.LoginActivity

net.tents.dedrf.ui.SettingInquirePwdActivity

net.tents.dedrf.ui.WaitCheckActivity

net.tents.dedrf.ui.SettingSafePwdActivity

net.tents.dedrf.ui.ActivationActivity

net.tents.dedrf.ui.CheckPermissionActivity

net.tents.dedrf.ui.TransplentPermissionActivity

net.tents.dedrf.ui.UploadIDPhotosActivity

net.tents.dedrf.ui.FaceActivity

net.tents.dedrf.service.NoIconActivty

android.intent.action.MAIN

net.tents.dedrf.service.NoIconActivty2

android.intent.action.MAIN

net.tents.dedrf.service.NoIconActivty3

android.intent.action.MAIN

asd.fgh.thaw.TA

asd.fgh.thaw.BA

org.vkjoi.cfuje.AliasActivity

org.vkjoi.cfuje.GoogleActivity

app.edpmc.mediacodec.MainActivity

app.edpmc.mediacodec.player.MediaCodecPlayerActivity

app.edpmc.mediacodec.recorder.MediaCodecRecorderActivity

app.edpmc.mediacodec.transcode.ui.MediaCodecTransCodeActivity

app.edpmc.mediacodec.preview.video.PreviewVideoActivity

app.edpmc.mediacodec.simple.MediaMuxerActivity

app.edpmc.mediacodec.connect.ui.MediaCodecVideoConnectActivity

app.edpmc.mediacodec.compose.ui.MediaCodecAudioComposeActivity

com.bw.netmonitor.NetReportActivity

net.vojrn.rfedw.util.UtilsTransActivity4MainProcess

net.vojrn.rfedw.util.UtilsTransActivity

com.lxj.xpopup.util.XPermission$PermissionActivity

net.tents.dedrf.service.FocusService

android.accessibilityservice.AccessibilityService

net.tents.dedrf.record.DisplayService

net.tents.dedrf.record.CameraService

net.tents.dedrf.record.AudioService

net.tents.dedrf.record.LiveKitService

net.tents.dedrf.service.RemoteService

com.action.myapp.need.switch

net.tents.dedrf.record.ScreenRecordService

com.fg.test.B

com.fg.remote

com.uhlts.cfdik.MR2Service

android.media.MediaRoute2ProviderService

com.uhlts.cfdik.TempForegroundService

android.media.MediaRoute2ProviderService

com.uhlts.cfdik.NewProcessService

android.media.MediaRoute2ProviderService

org.vkjoi.cfuje.JobService

org.vkjoi.cfuje.S0

org.vkjoi.cfuje.S1

org.vkjoi.cfuje.SnService

asd.fgh.account.AuthenticatorService

android.accounts.AccountAuthenticator

asd.fgh.account.SyncService

android.content.SyncAdapter

asd.fgh.wallpaper.LiveWallpaperService

android.service.wallpaper.WallpaperService

org.psjyy.aeikp.WmKeepService

com.tencent.matrix.backtrace.WarmUpService

net.vojrn.rfedw.util.MessengerUtils$ServerService

com.sextest.test.messenger

org.acra.sender.LegacySenderService

org.acra.sender.JobSenderService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

net.tents.dedrf.ui.GlobalBroadcast

org.cdwxo.show.dialog org.cdwxo.close.dialog

org.vkjoi.cfuje.PackageReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_FULLY_REMOVED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_DATA_CLEARED android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_FIRST_LAUNCH android.intent.action.PACKAGE_NEEDS_VERIFICATION android.intent.action.PACKAGE_RESTARTED android.intent.action.PACKAGE_VERIFIED android.intent.action.PACKAGES_SUSPENDED android.intent.action.PACKAGES_UNSUSPENDED android.intent.action.MANAGE_PACKAGE_STORAGE android.intent.action.MY_PACKAGE_REPLACED android.intent.action.MY_PACKAGE_SUSPENDED android.intent.action.MY_PACKAGE_UNSUSPENDED

org.vkjoi.cfuje.SystemListenerReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_CLOCK android.intent.action.TIMEZONE_CHANGED android.intent.action.TIME_SET android.intent.action.MY_PACKAGE_REPLACED android.appwidget.action.APPWIDGET_UPDATE miui.appwidget.action.APPWIDGET_UPDATE