HOW TO CHECK FOR MALWARE ON PHONE ANDROID
In recent years, Anubis, another Android banking trojan, has also used something similar to BRATA’s technique. The same technique was copied weeks later by another Android banked known as the Fanta SDK. Other defensive measures previously used by Android malwareīRATA’s factory reset is a unique method used by the malware to protect itself, but it is not the first time that Android malware has done so.įor example, in 2016, an Android banker named Android.SmsSpy would also lock devices by simulating a ransomware-like attack in order to distract users from the fact that their banking credentials were also stolen during the infection. In this case, BRATA uses a factory reset to protect itself from a security scan or an attempt to reverse-engineer its code. This includes attempts to run the BRATA trojan in a virtual environment, typically used by security researchers and mobile security tools.
In addition, the factory reset also removes the malicious app that contained the BRATA trojan, effectively removing any forensic evidence of where the attack might have come from.īut Cleafy researchers said that the factory reset operation could also be triggered automatically during another scenario beyond a successful bank transfer. The addition of the forced factory reset feature to new BRATA versions represents a clever addition to prevent victims from getting timely alerts about any suspicious transfer of funds, as the e-banking app would be removed from the device during the factory reset operation.Īs device owners would be looking to investigate why their devices lost all their installed apps, many would not think to check the status of their bank account and might not find out about the malicious transfer until days after it happened, giving the BRATA gang time to launder the stolen money.
Since 2018, the BRATA gang has used this tactic to gain a foothold on Android smartphones, search for e-banking apps, show fake login screens, and then collect the user’s banking credentials.įeatures added in subsequent versions have also allowed the malware to initiate financial transactions from the compromised devices and steal user funds, and some BRATA-infested apps have also managed to slip into the official Play Store in early 2021. Usually distributed via shady apps offered on equally shady websites, the BRATA gang’s tactics are focused on tricking non-technical users into installing these apps and then granting them overly-intrusive permissions over their devices. The new feature was discovered by researchers from security firm Cleafy in new samples of the BRATA malware spotted in the wild last month, in December 2021.Īlso known as “Brazilian Remote Access Tool Android,” the BRATA malware has been around since late 2018 and is one of the many Android banking trojans that has been active over the past few years.
Android malware will factory-reset a phone after stealing a user’s fundsĪn Android banking malware strain has recently received a new feature that allows its operators to reset a device to factory settings after they have stolen money from a victim’s bank account as a way to distract the owner from the recent theft and prevent them from taking any preventive measures.
0 kommentar(er)
