Full Report
It’s tax season in Indonesia and fraudsters are observed to be ramping up the fraud campaign involving fake Coretax apps, but behind it lies an industrialized MaaS infrastructure ready to strike anywhere.
Analysis Summary
# Tool/Technique: Gigabud / Coretax Fraud Infrastructure
## Overview
This campaign involves an industrialized Malware-as-a-Service (MaaS) infrastructure targeting Indonesian taxpayers. Fraudsters distribute fake "Coretax" applications (the official Indonesian tax system) to deliver mobile banking trojans, specifically variants of the **Gigabud** malware family. The purpose is to steal banking credentials, intercept SMS (for 2FA bypass), and perform unauthorized financial transactions via Accessibility Services abuse.
## Technical Details
- **Type:** Malware Family (Android Banking Trojan)
- **Platform:** Android
- **Capabilities:** Screen recording, keylogging, SMS interception, Accessibility Services abuse, automated gesture execution (ATS), and phishing overlay attacks.
- **First Seen:** Early variants identified around mid-2022; Coretax-specific campaign identified in early 2024.
## MITRE ATT&CK Mapping
- **[TA0042 - Resource Development]**
- T1583.001 - Acquire Infrastructure: Domains
- **[TA0037 - Command and Control]**
- T1071.001 - Application Layer Protocol: Web Protocols
- **[TA0006 - Access Device Technician]**
- T1430 - Access Accessibility Service
- **[TA0030 - Capture Device Data]**
- T1513 - Screen Capture
- T1636.002 - Ad-hoc Communication Content: SMS Messages
- **[TA0031 - Input Capture]**
- T1417.001 - Input Capture: Keylogging
## Functionality
### Core Capabilities
- **Credential Theft:** Uses fake login interfaces (phishing overlays) to harvest usernames and passwords for banking and government portals.
- **SMS Interception:** Reads incoming SMS messages to steal One-Time Passwords (OTPs) used in Two-Factor Authentication (2FA).
- **Remote Access:** Provides attackers with the ability to view the device screen in real-time.
### Advanced Features
- **Automated Transfer System (ATS):** Leverages Android Accessibility Services to simulate user clicks and gestures, allowing the malware to perform fund transfers automatically without user interaction.
- **MaaS Infrastructure:** The campaign utilizes a sophisticated backend that generates hundreds of unique phishing URLs and app variants dynamically to evade static blacklists.
## Indicators of Compromise
### File Names (Common)
- Coretax.apk
- DJP_Online.apk
- Update_Coretax_Pajak.apk
### Network Indicators (Defanged)
- **Phishing/C2 Domains:**
- pajak[.]eixgo[.]cc
- pajak[.]wpiego[.]cc
- pajakcoretax[.]com
- pelayanan-coretax[.]com
- pelayananonlinepajak[.]com
- registrasi-coretax[.]com
- sss-negov[.]com
- sso-tha[.]net
- taspen[.]xufgo[.]com
- **IP Addresses:**
- 172[.]67[.]175[.]60
- 104[.]21[.]31[.]66
- 137[.]220[.]194[.]7
### Behavioral Indicators
- Requests for "Accessibility Services" permission immediately after installation.
- Attempting to set itself as the default SMS application.
- Preventing the user from uninstalling the app by closing the "Settings" or "App Info" page automatically.
## Associated Threat Actors
- **Gigabud Developers/Affiliates:** An organized group operating a Malware-as-a-Service model, previously linked to campaigns across Southeast Asia (Thailand, Vietnam) and now Indonesia.
## Detection Methods
- **Behavioral Detection:** Monitor for apps requesting `BIND_ACCESSIBILITY_SERVICE` combined with suspicious network traffic to unknown domains.
- **Network Monitoring:** Block traffic to the high-volume DGA-like (Domain Generation Algorithm) subdomains (e.g., `*.xufgo.com`, `*.aqego.cc`).
- **Signature-based:** Standard AV signatures for Android trojans (Android.Trojan.Banker).
## Mitigation Strategies
- **User Education:** Advise users that the Indonesian Tax Authority (DJP) does not distribute applications via WhatsApp or unofficial APK links.
- **Disable Unknown Sources:** Ensure "Install from Unknown Sources" is disabled on enterprise mobile devices.
- **Accessibility Protection:** Educate users never to grant Accessibility Services permissions to apps that do not clearly require them for legitimate disability support.
- **Google Play Protect:** Ensure Play Protect is active, as it frequently updates signatures for Gigabud variants.
## Related Tools/Techniques
- **Goldoson:** Another mobile malware family using similar distribution methods in the region.
- **Vultur:** Similar use of screen recording and Accessibility Services for banking fraud.
- **Smishing (SMS Phishing):** The primary delivery mechanism for the initial malicious links.