Android malware BRATA wipes your device after stealing data

silversurfer

Level 84
Thread author
Verified
Helper
Top poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
7,544
The Android malware known as BRATA has added new and dangerous features to its latest version, including GPS tracking, the capacity to use multiple communication channels, and a function that performs a factory reset on the device to wipe all traces of malicious activity.

In December 2021, a report by Cleafy underscored the emergence of the malware in Europe, where it was seen targeting e-banking users and stealing their credentials with the involvement of fraudsters posing as bank customer support agents.

Analysts at Cleafy continued to monitor BRATA for new features, and in a new report published today, illustrate how the malware continues to evolve.
The new features spotted by Cleafy researchers in the latest BRATA versions include keylogging functionality, which complements the existing screen capturing function.
Although its exact purpose remains a mystery to the analysts, all new variants also have GPS tracking.

The scariest of the new malicious features is the performing of factory resets, which the actors perform in the following situations:
  1. The compromise has been completed successfully, and the fraudulent transaction is over (i.e. credentials have been exfiltrated).
  2. The application has detected that it runs on a virtual environment, most probably for analysis.
BRATA uses factory resets as a kill switch for self-protection, but since they wipe the device, they also introduce the possibility of sudden and irreversible loss of data for the victim.