Android malware BRATA wipes your device after stealing data

The Android malware known as BRATA has added new and dangerous features to its latest version, including GPS tracking, the capacity to use multiple communication channels, and a function that performs a factory reset on the device to wipe all traces of malicious activity.

BRATA was first spotted by Kaspersky back in 2019 as an Android RAT (remote access tool) that mainly targeted Brazilian users.

In December 2021, a report by Cleafy underscored the emergence of the malware in Europe, where it was seen targeting e-banking users and stealing their credentials with the involvement of fraudsters posing as bank customer support agents.

Analysts at Cleafy continued to monitor BRATA for new features, and in a new report published today, illustrate how the malware continues to evolve.

Tailored versions for different audiences

The latest versions of the BRATA malware now target e-banking users in the UK, Poland, Italy, Spain, China, and Latin America.

Each variant focuses on different banks with dedicated overlay sets, languages, and even different apps to target specific audiences.

The authors use similar obfuscation techniques in all versions, such as wrapping the APK file into an encrypted JAR or DEX package.

This obfuscation successfully bypasses antivirus detections, as illustrated by the VirusTotal scan below.

On that front, BRATA now actively seeks signs of AV presence on the device and attempts to delete the detected security tools before proceeding to the data exfiltration step.

New features

The new features spotted by Cleafy researchers in the latest BRATA versions include keylogging functionality, which complements the existing screen capturing function.

Although its exact purpose remains a mystery to the analysts, all new variants also have GPS tracking.

The scariest of the new malicious features is the performing of factory resets, which the actors perform in the following situations:

1. The compromise has been completed successfully, and the fraudulent transaction is over (i.e. credentials have been exfiltrated).
2. The application has detected that it runs on a virtual environment, most probably for analysis.

BRATA uses factory resets as a kill switch for self-protection, but since they wipe the device, they also introduce the possibility of sudden and irreversible loss of data for the victim.

Finally, BRATA has added new communication channels for exchanging data with the C2 server and now supports HTTP and WebSockets.

The option of WebSockets gives the actors a direct and low-latency channel that is ideal for real-time communication and live manual exploitation.

Moreover, because WebSockets doesn’t need to send headers with each connection, the volume of suspicious network traffic is reduced, and by extension, the chances of being detected are minimized.

Basic ways to stay safe

BRATA is only one of many Android banking trojans and stealthy RATs circulating in the wild, targeting people’s banking credentials.

The best way to avoid being infected by Android malware is to install apps from the Google Play Store, avoid APKs from shady websites, and always scan them with an AV tool before opening.

During installation, pay close attention to the requested permissions and avoid granting any that appear unnecessary for the app’s core functionality.

Finally, monitor battery consumption and network traffic volumes to identify any inexplicable spikes that may be attributed to malicious processes running in the background.