Android is the most popular mobile operating system in the world. Its user base far exceeds that of any other operating system. Such a huge user base has become delicious meat in the eyes of cybercriminals. Over the years, we can see that the Android platform has become the target of unscrupulous people again and again, endangering users’ private information and even causing property losses with varying degrees of attacks.
BRATA variant virus appears in Android system, which can evade anti-virus, steal financial data and restore the phone to its original factory settings
A malware that has proven to be particularly difficult to get rid of now has a variant, BRATA. This is a remotely accessible Trojan virus that was used to steal users’ banking and financial details in the past. The new variant has not only become more powerful, but also added a new process. After stealing the information, all the data in the user’s phone will be wiped out, so that you can’t trace it.
BRATA was first discovered by Kaspersky in 2019 and primarily targets Brazilian users with Android RATs (Remote Access Tools). In December 2021, a report by Cleafy emphasized that the malware was present in Europe and other places, targeting online banking and e-banking users, and stealing user credentials and other data with the participation of scammers pretending to be bank customer service agents.
After continued monitoring, it was discovered that the malware was targeting online business users in the UK, Poland, Italy, Spain, China and Latin America.
There are three types of BRATA variants (as shown below). Types A and B add GPS tracking functions and factory reset functions. They are more capable of evading obfuscation codes scanned by various anti-virus software, overlay pages customized for specific banks, and login information capture to more accurately target specific audiences. Type C is the primary application that can download and install secondary applications containing malware.
The best way to avoid being infected is to pay attention to apps that provide you with accessibility features and apps that ask you for administrator rights. BRATA uses accessibility service permissions to view content on the phone screen, including screenshots and user clicks. However, the biggest change in this series of malware is the introduction of the function of remote control to restore the user’s phone to its original settings. This will be triggered once the user’s financial details are successfully stolen. Another situation is that when BRATA suspects that it is running in a virtual environment, it will also perform the function of restoring the original settings. Of course, this is only possible if you have given administrator rights to the problematic application.
▲The BRATA variant will ask you for permission to clear all data (restore original settings)
There are all kinds of malware on the Internet that may infect your phone. We can’t control what malicious people do, but we can protect ourselves. The best way to avoid becoming a victim of mobile viruses is to make sure you are vigilant when installing apps, never grant access or administrator rights to an app, and always download and install apps from reliable, safe sources.
Source: KOCPC Chinese