Vultur Android Banking Trojan Reaches 100,000+ Downloads on Google Play Store

The Android banking Trojan Vultur has attained a total of much more than 100,000 downloads on the Google Play Retailer, claims a new advisory from cybersecurity authorities at Cleafy.

The dropper hides behind a pretend utility software. For the reason that of its comparatively limited permissions and little footprint, it appears as a legit app and can elude Google Participate in security measures.

“Although most of the banking trojans are dispersed via *ishing strategies, TAs [threat actors] also use formal app stores to supply their malware using dropper purposes, namely an application developed to obtain malware into the focus on product,” the Cleafy workforce explained.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

According to the advisory, 1 of the key motives driving this decision is reaching more prospective victims and securing a bigger probability of committing fraud.

“Furthermore, because these droppers conceal behind utility applications and arrive from a reliable supply, they can mislead even ‘experienced’ buyers,” Cleafy wrote.

“This describes why, even nevertheless an overview of this dropper was presently explained in the last article of Menace Cloth, we made the decision to publish this report and assess in depth how this software ended up in the Engage in Keep and attempted to dedicate bank fraud.”

From a specialized standpoint, following installation, the dropper works by using superior evasion strategies, like steganography, file deletion and code obfuscation, in addition to numerous checks ahead of downloading the malware.

“Once the banking trojan (Vultur) has been downloaded and set up by a faux update, threat actors can notice all the things that transpires on the contaminated equipment and have out financial institution fraud through account takeover attacks,” Cleafy defined.

According to the security experts, the Vultur campaigns clearly show how danger actors frequently boost their tactics to remain undetected employing highly developed evasion tactics.

“At the very same time, the use of official app shops to produce banking trojans to access a a lot more important variety of probable victims is a new craze that is gaining energy,” Cleafy additional. “We expect to see new refined banking droppers campaigns on the formal outlets in the future months.”

The advisory consists of a checklist of Indicators of Compromise (IoCs) for Vultur bacterial infections. The technological produce-up’s publication arrives times right after Malwarebytes introduced new data suggesting a team of 4 apps with in excess of a million downloads is listed on Google Perform and infected with the HiddenAds malware.