Malware

BRATA

BRATA is an Android banking trojan first observed in Brazil in 2019 and later associated with campaigns targeting banking customers in Europe, especially Italy. It is designed for on-device fraud against mobile banking users. Core behavior attributed to the original BRATA includes abuse of Android Accessibility Services to capture victim input and facilitate operator control, collection of account information from compromised devices, retrieval of Android system and hardware information, and exfiltration of stolen data to command-and-control infrastructure. BRATA has been observed communicating with its operators over HTTP and WebSockets.

Campaigns associated with BRATA have used mobile-focused social engineering chains in which victims receive bank-themed SMS lures leading to phishing or malware-delivery pages, followed in some cases by phone calls from fraud operators who persuade victims to install the malicious application and grant permissions. Once installed, BRATA variants have been reported to request permissions that support banking fraud, including accessibility abuse and SMS interception, and to include screen recording or casting functionality that enables attackers to observe or interact with the victim device during fraudulent transactions.

Later reporting has argued that some malware long grouped under the BRATA label actually comprises distinct Android banking malware families, notably AmexTroll and Copybara, rather than new BRATA variants. Under that interpretation, the original BRATA family is primarily tied to the earlier Brazil-focused activity and no new original BRATA samples were observed after 2019. Even with that taxonomy dispute, BRATA remains widely recognized as an Android banking trojan associated with credential and account-data theft, remote fraud enablement, and mobile-banking-focused social engineering.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.004Spearphishing VoiceEvidence1

Malicious actors are resorting to voice phishing (vishing) tactics to dupe victims into installing Android malware on their devices... Telephone-oriented attack delivery (TOAD)... involves calling the victims using previously collected information from the fraudulent websites.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

the first appearance of this name dates back to middle of 2019, while this malware family was reported to abuse a CVE in the popular instant messaging application WhatsApp to target victims in Brazil.

Execution

3 techniques

T1203Exploitation for Client ExecutionEvidence1

T1204User ExecutionEvidence1

a fraud operator calls the victim and uses social engineering techniques to persuade the user to install the malicious app.

T1204.002Malicious FileEvidence1

After the victim visits the website (only visible via mobile) and downloads the malicious app, a fraud operator calls the victim and uses social engineering techniques to persuade the user to install the malicious app.

Persistence

1 technique

T1546Event Triggered ExecutionEvidence2

This malware family was also capable of keylogging data from victim’s devices thanks to Accessibility Service abuse, like most modern malware families are able to do nowadays.

Privilege Escalation

2 techniques

T1546Event Triggered ExecutionEvidence2

This malware family was also capable of keylogging data from victim’s devices thanks to Accessibility Service abuse, like most modern malware families are able to do nowadays.

T1548.005Temporary Elevated Cloud AccessEvidence1

Once the malicious app is installed, the fraud operators can take control of the victim infected devices thanks to the abuse of the Accessibility services

Stealth

1 technique

T1036MasqueradingEvidence1

The first campaign was quite limited in size, and was followed a few months after, between the end of 2021 and the beginning of 2022, by more refined campaigns, still targeting Italy, posing as an array of security related applications.

Credential Access

3 techniques

T1056Input CaptureEvidence2

In some cases, the link redirects the victim to a phishing page that looks like the bank’s, and it is used to steal credentials and other relevant information (e.g. fiscal code and security questions).

T1056.001KeyloggingEvidence3

we also intercepted multiple attempts of pin/otp validations stolen by TAs through the malicious app (or phishing website).

T1649Steal or Forge Authentication CertificatesEvidence1

Through the malware installed on the victim device, Threat Actors can receive on their server the 2FA code sent by the bank and perform fraudulent transactions.

Discovery

1 technique

T1087Account DiscoveryEvidence1

BRATA has collected account information from compromised devices. Corona Updates can collect voice notes, device accounts, and gallery images. GolfSpy can collect local accounts on the device.

Collection

3 techniques

T1056Input CaptureEvidence2

T1056.001KeyloggingEvidence3

we also intercepted multiple attempts of pin/otp validations stolen by TAs through the malicious app (or phishing website).

T1113Screen CaptureEvidence1

with the abuse of Accessibility Service and the screen recording, TAs can perform actions on the infected device

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

BRATA can use both HTTP and WebSockets to communicate with the C2 server. GPlayed has communicated with the C2 using HTTP requests or WebSockets as a backup. LightSpy has used both HTTPS and Websockets to communicate with the C2. | AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; Android/AdDisplay.Ashas has communicated with the C2 server using HTTP; Android/Chuli.A used HTTP uploads to a URL as a command and control mechanism; Asacub has communicated with the C2 using HTTP POST requests; BOULDSPY uses unencrypted HTTP traffic between the victim and C2 infrastructure; BRATA can use both HTTP and WebSockets to communicate with the C2 server; Bread communicates with the C2 server using HTTP requests; PROMETHIUM used StrongPity to communicate with the C2 server using HTTPS; Cerberus communicates with the C2 server using HTTP; Chameleon can use HTTP to communicate with the C2 server; CHEMISTGAMES has used HTTPS for C2 communication; Concipit1248 communicates with the C2 server using HTTP requests; Corona Updates communicates with the C2 server using HTTP requests; Dark Caracal controls implants using standard HTTP communication; EventBot communicates with the C2 using HTTP requests; Exobot has used HTTPS for C2 communication; Exodus One checks in with the command and control server using HTTP POST requests; FluBot can use HTTP POST requests on port 80 for communicating with its C2 server; FlyTrap can use HTTP to communicate with the C2 server; Golden Cup has communicated with the C2 using MQTT and HTTP; GoldenEagle has used HTTP POST requests for C2; GPlayed has communicated with the C2 using HTTP requests or WebSockets as a backup; Gustuff communicates with the command and control server using HTTP requests; Hornbill can use HTTP and HTTP POST to communicate information to the C2; INSOMNIA communicates with the C2 server using HTTPS requests; LightSpy has used both HTTPS and Websockets to communicate with the C2; Red Alert 2.0 has communicated with the C2 using HTTP; RedDrop uses HTTP requests for C2 communication; Riltok communicates with the command and control server using HTTP requests; Rotexy can communicate with the command and control server using JSON payloads sent in HTTP POST request bodies; RuMMS uses HTTP for command and control; SharkBot can use HTTP to send C2 messages to infected devices; SilkBean has used HTTPS for C2 communication; Skygofree can be controlled via HTTP; SpyC23 can communicate with the Command and Control server using HTTPS; TrickMo communicates with the C2 by sending JSON objects over unencrypted HTTP requests; ViceLeaker uses HTTP requests for C2 communication; YiSpecter has connected to the C2 server via HTTP.

Exfiltration

1 technique

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

BRATA has exfiltrated data to the C2 server using HTTP requests.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

threatfabric blogNews

Dec 15, 2022

BrasDex: A new Brazilian ATS Android Banker with ties to Desktop malware

Referenced as an example of Brazilian mobile malware families that gained prominence and expanded to Europe.

cyble comNews

Oct 27, 2022

Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers

Referenced as a well-known Android banking trojan that heavily relies on Accessibility Service.

the hacker newsNews

Oct 12, 2022

Hackers Using Vishing to Trick Victims into Installing Android Banking Malware

Android banking malware family referenced as being confused with Copybara and used in smishing-plus-vishing social engineering campaigns.

threatfabric blogNews

Aug 4, 2022

Brata - a tale of three families

Android banking malware family first seen in 2019 targeting victims in Brazil, reportedly abusing a WhatsApp CVE and using Accessibility Service abuse for keylogging. The article argues later 'Brata' reporting conflated this original family with two distinct families, AmexTroll and Copybara.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BRATA