Full Report
Delve into the tactics of the GoldDigger Trojan and discover ways to safeguard your customers
Analysis Summary
# Tool/Technique: GoldDigger Trojan
## Overview
GoldDigger is a sophisticated Android banking Trojan primarily targeting financial institutions and their customers. Its primary objective is to steal banking credentials, intercept SMS messages, and perform unauthorized fund transfers by leveraging Android’s Accessibility Services to interact with other applications and bypass security measures.
## Technical Details
- **Type:** Malware Family (Banking Trojan)
- **Platform:** Android
- **Capabilities:** Credential theft, SMS interception, Keylogging, UI injection, and Automated Transfer System (ATS) functionality.
- **First Seen:** Approximately mid-to-late 2023 (Active campaigns identified in Vietnam).
## MITRE ATT&CK Mapping
- **TA0034 - Primary Tactic: Persistence**
- T1624.001 - Event Notification: Accessibility Service
- **TA0037 - Primary Tactic: Credential Access**
- T1417.001 - Input Capture: Keylogging
- T1516 - Adversary-in-the-Middle (via SMS interception)
- **TA0035 - Primary Tactic: Discovery**
- T1420 - Device Information Discovery
- **TA0030 - Primary Tactic: Impact**
- T1499 - Endpoint Denial of Service (via locking device screen during theft)
## Functionality
### Core Capabilities
- **Accessibility Service Exploitation:** Requests permissions to use Accessibility Services to monitor the screen, capture user inputs, and click buttons without user consent.
- **SMS Interception:** Captures incoming SMS messages to steal One-Time Passwords (OTPs) and Two-Factor Authentication (2FA) codes.
- **Credential Phishing:** Uses overlay attacks (UI injection) to display fake login pages over legitimate banking apps.
- **Information Stealing:** Exfiltrates device metadata, contact lists, and installed application lists to the C2 server.
### Advanced Features
- **Automated Transfer System (ATS):** Can automate the process of filling out transfer forms within banking apps to drain accounts rapidly.
- **Anti-Analysis/Evasion:** Employs obfuscation techniques to hide its malicious intent from mobile antivirus scanners.
- **Persistent C2 Communication:** Uses a series of rotating domains to maintain connection with the command-and-control infrastructure.
## Indicators of Compromise
### File Hashes (SHA256)
- 7063d18d8507b69a477ef0a65a5843d21ff30e8f41b40ae916ab1afd573d1b47
- 7c8a8a06d454e6437c033d5e0f617d1c4e6dbc7f9d429fb2e7f758e6781517a3
- 4c5f2aba6418582bb95cae5e9b365540bc5ea07b19d643b76111e9795af92e87
- 26dae7a7bd23144101593966abdba68fa1da0fae0502fda7ef1da42657cfea12
- efd45dd23e4909693f41fe06cc013eb025237569e1e674bcb6254102e13d0a2c
### Network Indicators (Defanged)
- **Malware Delivery:**
- cskh[.]evnspa[.]cc
- viet[.]egovn[.]cc
- vietgovn[.]cc
- vietcp[.]cc
- **C2 Servers:**
- hds6y[.]cc
- ks8cb[.]cc
- ms2ve[.]cc
- smgeo[.]cc
- wbke[.]cc
- zu7kt[.]cc
### Behavioral Indicators
- Requesting high-risk permissions (Accessibility Services, SMS Read/Write, Overlay) immediately after installation.
- Hiding the application icon from the launcher after the initial setup.
## Associated Threat Actors
- Currently tracked as a localized cluster targeting Southeast Asia (Vietnam). Specific group names have not been publicly finalized, though the infrastructure suggests organized cybercrime operations.
## Detection Methods
- **Behavioral Detection:** Monitoring for unauthorized use of Accessibility Services by applications not listed in official app stores.
- **Network Monitoring:** Alerting on traffic to known `.cc` delivery domains or specific C2 patterns.
- **Signature-based:** Standard AV signatures for the identified SHA256 hashes.
## Mitigation Strategies
- **User Education:** Advise customers never to enable "Accessibility Services" for apps downloaded outside the Google Play Store.
- **Sideloading Restrictions:** Disable the "Install from Unknown Sources" setting on Android devices.
- **App Hardening:** Banks should implement RASP (Runtime Application Self-Protection) to detect overlays and screen-sharing/recording.
## Related Tools/Techniques
- **GoldFactory:** The broader framework/operation associated with the distribution of GoldDigger and its variants (like GoldPickaxe).
- **Gigabud:** Another Android banking Trojan using similar social engineering and delivery tactics in the region.