vultur | 4e0a69bf232a9c12ec915bac7dd6789adb2116927b51f10e4bd996cbde854682

Analysis

max time kernel
21s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
09/10/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e0a69bf232a9c12ec915bac7dd6789adb2116927b51f10e4bd996cbde854682.apk
Size

2.1MB
MD5

db2b8d9e6a63938611648554990c4554
SHA1

b11c00bf6f049c3ee2b54d5372340d1c30191ddd
SHA256

4e0a69bf232a9c12ec915bac7dd6789adb2116927b51f10e4bd996cbde854682
SHA512

9dded3680a1425d12cb8bea30918626b8373566ac32b47fcb757ad960be2532009430fab2ce4fcd63f9c041f17a65b3c6f8b8d07022c98587fd250d9be0370ce
SSDEEP

49152:yrm0ADPDFE4z5V+ek1i+qzyd4N/h5uKgWR:yCt779kPiu8

Score

10^/10

vultur banker discovery evasion impact infostealer trojan

Malware Config

Signatures

Vultur
Vultur is an Android banking trojan first seen in March 2021.
infostealer trojan banker vultur

Vultur payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-18.dat	family_vultur
behavioral1/memory/4252-1.dex	family_vultur

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rest.tymkos/files/xzglduvrykldjpdk.dex	4252	com.rest.tymkos
/data/user/0/com.rest.tymkos/files/xzglduvrykldjpdk.dex	4324	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rest.tymkos/files/xzglduvrykldjpdk.dex --output-vdex-fd=71 --oat-fd=76 --oat-location=/data/user/0/com.rest.tymkos/files/oat/x86/xzglduvrykldjpdk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rest.tymkos/files/xzglduvrykldjpdk.dex	4252	com.rest.tymkos
/data/user/0/com.rest.tymkos/files/zcwitmneqqgwpvmm.dex	4252	com.rest.tymkos
/data/user/0/com.rest.tymkos/files/zcwitmneqqgwpvmm.dex	4387	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rest.tymkos/files/zcwitmneqqgwpvmm.dex --output-vdex-fd=71 --oat-fd=76 --oat-location=/data/user/0/com.rest.tymkos/files/oat/x86/zcwitmneqqgwpvmm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rest.tymkos/files/zcwitmneqqgwpvmm.dex	4252	com.rest.tymkos

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rest.tymkos

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rest.tymkos

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rest.tymkos

com.rest.tymkos
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4252
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rest.tymkos/files/xzglduvrykldjpdk.dex --output-vdex-fd=71 --oat-fd=76 --oat-location=/data/user/0/com.rest.tymkos/files/oat/x86/xzglduvrykldjpdk.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4324
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rest.tymkos/files/zcwitmneqqgwpvmm.dex --output-vdex-fd=71 --oat-fd=76 --oat-location=/data/user/0/com.rest.tymkos/files/oat/x86/zcwitmneqqgwpvmm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4387

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact