GoldDigger Malware Exposed: Sophisticated Packer Hides Code from Detection

IBM Trusteer researchers have published an in-depth analysis of GoldDigger, a financial Android banking trojan discovered by Group-IB in 2023. The malware primarily targets mobile banking users in South Africa and Europe, with a clear intent to expand operations globally.

GoldDigger uses a sophisticated packer called 'dpt-shell' to hide its code, prevent analysis, and evade detection. This packer is implemented inside a native shared library (.so) file called 'libdpt.so' and located in the malware's assets directory.

The researchers also found that GoldDigger hooks libart.so, the core Android Runtime (ART) library, to intercept class loading and modify bytecode at runtime. This allows the malware to hide malicious classes from analysis.