Security News > 2022 > January > Mobile Banking Trojan BRATA Gains New, Dangerous Capabilities
The Android malware tracked as BRATA has been updated with new features that grants it the ability to track device locations and even perform a factory reset in an apparent bid to cover up fraudulent wire transfers.
"What makes Android RAT so interesting for attackers is its capability to operate directly on the victim devices instead of using a new device," Cleafy researchers noted in December 2021.
First seen in the wild at the end of 2018 and short for "Brazilian Remote Access Tool Android," BRATA initially targeted users in Brazil and then rapidly evolved into a feature-packed banking trojan.
The latest "Tailored" samples of BRATA set aim at different countries and constitute an initial dropper - a security app dubbed "iSecurity" - that remains undetected by virtually all malware scanning engines and is used to download and execute the real malicious software.
The new versions have incorporated a kill switch mechanism that allows the operators to restore the Android phone to its factory settings upon successfully completing a fraudulent wire transfer or in scenarios where the application is installed in a virtual environment.
"BRATA is trying to reach out to new targets and to develop new features," the researchers said, adding threat actors are "Leveraging this banking trojan for performing frauds, typically through unauthorized wire transfer or through Instant Payments, using a wide network of money mules accounts in multiple European countries."
News URL
https://thehackernews.com/2022/01/mobile-banking-trojan-brata-gains-new.html
Related news
- Chameleon Android Banking Trojan Targets Users Through Fake CRM App (source)
- Czech Mobile Users Targeted in New Banking Credential Theft Scheme (source)
- Rocinante Trojan Poses as Banking Apps to Steal Sensitive Data from Brazilian Android Users (source)
- TrickMo Android Trojan Exploits Accessibility Services for On-Device Banking Fraud (source)
- New Octo2 Android Banking Trojan Emerges with Device Takeover Capabilities (source)