golddigger | 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf

Sharing

Copy URL Twitter E-mail

General

Target
112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
Size 31.7MB
Sample260923-g9txasff33
SHA256 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
MD5 232939a64c11f6535ace11e260d5f811
SHA1 1f36410ec83e0a613de517bcb358f98c9ea54ca2
SHA512 f8d77406c6ea5ca816cbe7d35eceb9e5ab399ade5152f06b1d26d44bbf65c4301f99fae6774a553e8e97a106ac729697bf2a1f6afbfee3623c9766bc2738485d
SSDEEP 786432:1m9ReADdGK4aq9ITw9tnZctTMSyeAjhhCjX1Ywl7Vh:1mDV79utZcISyxjhhuX1BpVh
TLSH
T16C772307F3B2DDA4E8FF023814731112231B5E569AC78E876648F5AE28776E51F8CAC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer banker golddigger

Malware Config

Signatures

Family: GoldDigger
GoldDigger is an Android malware that targets various Vietnam banking applications first seen in June 2023.
trojan infostealer banker golddigger

GoldDigger payload 2 IoCs

resource	yara_rule
sample	family_golddigger
sample	family_golddigger

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Requests dangerous framework permissions 14 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf

File Explorer

112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf

.apk 31.7MB

112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf

SHA256 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
MD5 232939a64c11f6535ace11e260d5f811
SHA1 1f36410ec83e0a613de517bcb358f98c9ea54ca2
SHA512 f8d77406c6ea5ca816cbe7d35eceb9e5ab399ade5152f06b1d26d44bbf65c4301f99fae6774a553e8e97a106ac729697bf2a1f6afbfee3623c9766bc2738485d
SSDEEP 786432:1m9ReADdGK4aq9ITw9tnZctTMSyeAjhhCjX1Ywl7Vh:1mDV79utZcISyxjhhuX1BpVh
TLSH
T16C772307F3B2DDA4E8FF023814731112231B5E569AC78E876648F5AE28776E51F8CAC5
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

GoldDigger payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d1dd0231808a96ce30c17ead9820463240800cd43346293604e5a51f2ddadbdc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Th,OU=feaf7f4488b345e998e8a1630854c6c4,O=feaf7f4488b345e998e8a1630854c6c4,L=feaf7f4488b345e998e8a1630854c6c4,ST=feaf7f4488b345e998e8a1630854c6c4,C=50

com.hcvxr.ufnxqd

android.permission.CAMERA android.permission.READ_SMS android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.RECORD_AUDIO android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_EXTERNAL_STORAGE android.permission.GRANT_RUNTIME_PERMISSIONS android.permission.READ_PRIVILEGED_PHONE_STATE android.permission.DISABLE_KEYGUARD android.permission.WAKE_LOCK android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.SYSTEM_ALERT_WINDOW android.permission.FOREGROUND_SERVICE android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.USE_FULL_SCREEN_INTENT android.permission.INTERNET android.permission.BATTERY_STATS android.permission.REORDER_TASKS android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_BACKGROUND_LOCATION android.permission.READ_CONTACTS android.permission.AUTHENTICATE_ACCOUNTS android.permission.GET_ACCOUNTS android.permission.WRITE_SYNC_SETTINGS android.permission.SCHEDULE_EXACT_ALARM android.permission.SYSTEM_OVERLAY_WINDOW android.permission.USE_EXACT_ALARM android.permission.FOREGROUND_SERVICE_DATA_SYNC android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.MANAGE_EXTERNAL_STORAGE com.hcvxr.ufnxqd.backtrace.warmed_up com.hcvxr.ufnxqd.manual.dump com.hcvxr.ufnxqd.matrix.permission.PROCESS_SUPERVISOR android.permission.READ_PHONE_STATE

ngodanao.fdsnofdno.fdsfnso.LoginActivity

ngodanao.fdsnofdno.fdsfnso.SettingSafePwdActivity

ngodanao.fdsnofdno.fdsfnso.SettingInquirePwdActivity

ngodanao.fdsnofdno.fdsfnso.ModelCheckActivity

ngodanao.fdsnofdno.fdsfnso.CheckPermissionActivity

ngodanao.fdsnofdno.fdsfnso.WaitCheckActivity

ngodanao.fdsnofdno.fdsfnso.ActivationActivity

ngodanao.fdsnofdno.fdsfnso.SplashActivity

android.intent.action.MAIN

io.mhwav.oliki.ui.LoginActivity

io.mhwav.oliki.ui.SettingInquirePwdActivity

io.mhwav.oliki.ui.WaitCheckActivity

io.mhwav.oliki.ui.SettingSafePwdActivity

io.mhwav.oliki.ui.ActivationActivity

io.mhwav.oliki.ui.CheckPermissionActivity

io.mhwav.oliki.ui.TransplentPermissionActivity

io.mhwav.oliki.ui.UploadIDPhotosActivity

io.mhwav.oliki.ui.FaceActivity

asd.fgh.thaw.TA

asd.fgh.thaw.BA

app.eadjl.adqay.AliasActivity

app.eadjl.adqay.GoogleActivity

org.ujewx.mediacodec.MainActivity

org.ujewx.mediacodec.player.MediaCodecPlayerActivity

org.ujewx.mediacodec.recorder.MediaCodecRecorderActivity

org.ujewx.mediacodec.transcode.ui.MediaCodecTransCodeActivity

org.ujewx.mediacodec.preview.video.PreviewVideoActivity

org.ujewx.mediacodec.simple.MediaMuxerActivity

org.ujewx.mediacodec.connect.ui.MediaCodecVideoConnectActivity

org.ujewx.mediacodec.compose.ui.MediaCodecAudioComposeActivity

com.bw.netmonitor.NetReportActivity

org.spysr.bedda.util.UtilsTransActivity4MainProcess

org.spysr.bedda.util.UtilsTransActivity

com.lxj.xpopup.util.XPermission$PermissionActivity

io.mhwav.oliki.service.FocusService

android.accessibilityservice.AccessibilityService

io.mhwav.oliki.record.DisplayService

io.mhwav.oliki.record.CameraService

io.mhwav.oliki.record.AudioService

io.mhwav.oliki.record.LiveKitService

io.mhwav.oliki.service.RemoteService

com.action.myapp.need.switch

net.pmole.record.ScreenRecordService

com.fg.test.B

com.fg.remote

io.rusfc.ujdwx.MR2Service

android.media.MediaRoute2ProviderService

io.rusfc.ujdwx.TempForegroundService

android.media.MediaRoute2ProviderService

io.rusfc.ujdwx.NewProcessService

android.media.MediaRoute2ProviderService

app.eadjl.adqay.JobService

app.eadjl.adqay.S0

app.eadjl.adqay.S1

app.eadjl.adqay.SnService

asd.fgh.account.AuthenticatorService

android.accounts.AccountAuthenticator

asd.fgh.account.SyncService

android.content.SyncAdapter

asd.fgh.wallpaper.LiveWallpaperService

android.service.wallpaper.WallpaperService

io.qzzvw.bbwxq.WmKeepService

com.frpc.FrpcService

com.tencent.matrix.backtrace.WarmUpService

org.spysr.bedda.util.MessengerUtils$ServerService

com.sextest.test.messenger

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

org.acra.sender.LegacySenderService

org.acra.sender.JobSenderService

androidx.room.MultiInstanceInvalidationService

io.mhwav.oliki.ui.GlobalBroadcast

net.pmole.show.dialog net.pmole.close.dialog

app.eadjl.adqay.PackageReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_FULLY_REMOVED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_DATA_CLEARED android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_FIRST_LAUNCH android.intent.action.PACKAGE_NEEDS_VERIFICATION android.intent.action.PACKAGE_RESTARTED android.intent.action.PACKAGE_VERIFIED android.intent.action.PACKAGES_SUSPENDED android.intent.action.PACKAGES_UNSUSPENDED android.intent.action.MANAGE_PACKAGE_STORAGE android.intent.action.MY_PACKAGE_REPLACED android.intent.action.MY_PACKAGE_SUSPENDED android.intent.action.MY_PACKAGE_UNSUSPENDED

app.eadjl.adqay.SystemListenerReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_CLOCK android.intent.action.TIMEZONE_CHANGED android.intent.action.TIME_SET android.intent.action.MY_PACKAGE_REPLACED android.appwidget.action.APPWIDGET_UPDATE miui.appwidget.action.APPWIDGET_UPDATE