How To Protect Your Android Device From The New BrazKing Android Malware?

BrazKing is a banking Trojan for Android that belongs to the RAT family. According to a report, the New BrazKing Android Malware has been in existence since 2018 November and it is most likely operated by a local threat organization and primarily targets Brazilian mobile banking users. It turns out that the Malware’s creators have been working to make it more agile than before.

This post details our findings regarding the New BrazKing Malware version, its dynamic mechanisms, features that enable cybercriminals to use it in mobile banking fraud, and finally how Android users can prevent its attack. As I write this, we can see that BrazKing is still in development, and we anticipate that there will be more soon.

What Is New In The New BrazKing Android Malware?

The New BrazKing Android Malware, according to the strain, automates a call to the attacker’s server, requesting those matches on the fly. The virus now detects which program is being used on the server-side, and it sends on-screen material to the C2. Credential grabbing is then initiated by the C2 server rather than by a command from the virus.

The added agility here is that the attacker can choose or skip the next action based on the victim’s IP address or if the Malware is being run on an emulator. They can change what is returned. They can change the target list at any time without having to change the Malware.

In addition, the new trojan type has increased screen overlay functionality. On Android smartphones, traditional overlay malware creates a phony screen on top of the original banking apps. BrazKing now works without the SYSTEM ALERT WINDOW permission, which helps BrazKing to be more elusive.

The New BrazKing Android Malware loads the fake screen’s URL from the C2 into a WebView in a window displaying its overlay screen. Users can open links within apps using Android System WebView without having to exit the app. When adding the WebView from within the accessibility service, BrazKing utilizes TYPE ACCESSIBILITY OVERLAY as the window type. The overlay window then appears on the screen, covering the original app and displays such as the ‘Settings’ menu window. While the actual app is covered with a phony overlay, BrazKing may intercept the views in the background, touch buttons, and even enter text in Android text views while presenting the overlay screen to the user.

What Is BrazKing Android Malware Capable Of Doing?

How Does The New BrazKing Android Malware Infect Victims?

The infection process begins with a social engineering message that links to an HTTPS website that alerts potential victims about security risks with their devices and offers the option to update to the most recent version of the operating system or google services. However, for the attacks to succeed, users must enable a setting to install programs from unknown sources.

Targets (Victims) Of The BrazKing Android Malware:

The New BrazKing Android Malware is found to be targeting most likely Brazilian users which use Android devices.

How To Protect Your Device From The New BrazKing Android Malware?

The New BrazKing Android Malware is harmful, and Android users should be cautious. If a person cannot uninstall an application, factory reset their smartphone, or install antivirus, and they should detect being infected by the New BrazKing Android Malware. The following are best protection remedies:

IOCs Of The New BrazKing Android Malware:

We hope this post would help you in knowing How To Protect Your Android Device From the New BrazKing Android Malware. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.

You may also like these articles: