gigabud

General

Target
tj-identitas2 16 jan 20.30.apk
Size 41.6MB
Sample260116-q3nldaay7b
SHA256 2f5ce1de2669ce6ca87164cf51e94c2d91ff2f5ad8700df7320bcc39485546ef
MD5 161826c77ffbca96a92a70e8180fd111
SHA1 e28d34648fa946391c37f57c401d3305abd0c92e
SHA512 43eec074a49bd674bf5c154f328e241e6f513d405b67660b3391095f10f136b02d75dff1ef6547fef57db3757b5a218a44ec9dcf856d7e2f42cc55ab0f1a2f81
SSDEEP 786432:DyReADdGK4aq9IFRVh7oC3tnZctTMSbOHIMVpdKoIUNOT0ty9ErRy3vCkV1m1weJ:DGV73Dh7h3tZcISbCIMVTxpcsy3vjA1/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  tj-identitas2 16 jan 20.30.apk
- Size 41.6MB
- SHA256 2f5ce1de2669ce6ca87164cf51e94c2d91ff2f5ad8700df7320bcc39485546ef
- MD5 161826c77ffbca96a92a70e8180fd111
- SHA1 e28d34648fa946391c37f57c401d3305abd0c92e
- SHA512 43eec074a49bd674bf5c154f328e241e6f513d405b67660b3391095f10f136b02d75dff1ef6547fef57db3757b5a218a44ec9dcf856d7e2f42cc55ab0f1a2f81
- SSDEEP 786432:DyReADdGK4aq9IFRVh7oC3tnZctTMSbOHIMVpdKoIUNOT0ty9ErRy3vCkV1m1weJ:DGV73Dh7h3tZcISbCIMVTxpcsy3vjA1/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution gigabud golddigger impact infostealer persistence rat trojan
- Gigabud
  Gigabud is an Android RAT first seen in July 2022.
  rat trojan infostealer gigabud
- Gigabud family
  gigabud
- Gigabud payload
- GoldDigger
  GoldDigger is an Android malware that targets various Vietnam banking applications first seen in June 2023.
  trojan infostealer banker golddigger
- GoldDigger payload
- Golddigger family
  golddigger
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1