New Strain of Android RAT Targets Banking and Crypto
Mobile security researchers published information on a previously unknown Android malware, dubbed Vultur. The malware acts as a remote access trojan and abuses screen recording to steal data from banking and crypto applications.
Vultur abuses VNC or virtual network computing screen-recording and screen-sharing capabilities to monitor activity on the screens of infected devices. Vultur's primary targets, according to researchers, were applications used for banking and crypto wallet management, with a focus on European countries and Australia.
For a while the malware managed to survive detection and was distributed on the official Google Play Store, tucked away into a malicious app called "Protection Guard", posing as a phone security helper. The malicious app managed to score over 5 thousand downloads.
What sets Vultur apart from similar RAT malware is that it does not rely on HTML overlays that exfiltrate credentials. Researchers noted that the overlay approach usually requires "a larger time and effort investment". Instead, Vultur relies on screen recording and keylogging, which is an easier and more scalable approach.
Traditionally, banking malware would use a convincing recreation of the original interface and login page of an app that is displayed on top of the original app, capturing any credentials entered. Researchers believe that threat actors are gradually abandoning this approach and trying to figure out new, more efficient ways to steal credentials.
The researchers who examined Vultur also found some similarities between the new RAT and a previously existing piece of Android malware named Brunhilda. Brunhilda is a dropper used to distribute different final payloads, in what researchers call "dropper-as-a-service" model.
The bottom line is an observable trend and push to move away from trojans purchased on hacker websites and bad actors focusing more on malware that is more scalable and better suited to their specific needs. The structure of malware like Vultur allows all actions to be scripted and built into the backend and allow for easier hit and run attacks.
