Android users in Finland are being cautioned against deceptive tactics involving antivirus brands used in banking scams. According to a recent warning by Finland’s National Cybersecurity Centre, cybercriminals are duping users into downloading a fake McAfee antivirus application. Unfortunately, this application is actually a trojan dropper named Brunhilda, part of the Vultur Android banking trojan (ABT) family. This scam has already resulted in significant financial losses, with one victim reporting a loss of 95,000 euros. Research conducted by VMX Labs found indicators that other anti-virus brands are also being misused in the wild, potentially targeting Finnish speakers.

The two samples we have do not look like the droppers listed by Fox-IT but we managed to obtain a screenshot from showing that one of those samples might be hosted in one of the below dropper distribution URLs on April 29th. In addition, our newly registered domain analysis indicates that “mcafee[.]786791[.]com” was resolved to the same malicious IP address. This is the dropper URL pattern of the Vultur ABT mentioned in the Fox-IT article.

The last sample we obtained (M-VIP.Protect.apk) is a Brunhilda dropper. It is confirmed by the YARA rule published in the Fox-IT article.

Malicious Android Applications

Filename SHA-256
F-Secure_Protect.apk b4230592c46b7d87a63f25c6f88dcc4b271636a55febe388e0077c89128b0158
McAfee_Security.apk ef04b246dc6c3ba619994cdbbaf010833d7164ef98d3ef04696223a132b793da
M-VIP.Protect.apk de401b70d2d7f8090c0ed48ca310647246d4956dfd21abb633d14ad910c7566f

Dropper Distribution URLs

  • protect[.]641869[.]com
  • protect[.]918357[.]com
  • protect[.]065481[.]com
  • protect[.]864659[.]com
  • suojaa[.]354269[.]com (suojaa means protect in Finnish)
  • suojaa[.]065481[.]com (suojaa means protect in Finnish)
  • m-vip[.]065481[.]com

C2 servers

  • brustworth[.]online
  • gultopenfire[.]online

Note: Special thanks to the MalwareHunterTeam and Fox-IT, whose earlier findings have greatly contributed to this ongoing research.