Date: 09/10/2026
Severity: Medium
Summary
GoldFactory has weaponized Vwork, a modified version of the open-source Android cloning app Shelter, as an add-on to the Gigabud Android banking trojan. Vwork uses the Android Work Profile to clone banking applications into an isolated space, helping hide Gigabud from security detection while maintaining remote control of victims’ devices. The Gigabud–Vwork infection chain was confirmed in Indonesia, with activity targeting users across Asia, the Middle East, Africa, and Latin America.
Indicators of Compromise (IOC) List
Hash | b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501
ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae
4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc
112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611
1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c
0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3
66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb
61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | sha256hash IN ("4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc","112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb","ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae","1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c","9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611","b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3","61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc")
|
Reference:
https://www.group-ib.com/blog/vwork-app-cloning-gigabud-goldfactory/