Android malware BrazKing returns as a stealthier banking trojan

guest · Nov 18, 2021

Android malware BrazKing returns as a stealthier banking trojan
November 18, 2021
https://www.bleepingcomputer.com/ne...zking-returns-as-a-stealthier-banking-trojan/

The BrazKing Android banking trojan has returned with dynamic banking overlays and a new implementation trick that enables it to operate without requesting risky permissions.

A new malware sample was analyzed by IBM Trusteer researchers who found it outside the Play Store, on sites where people end up after receiving smishing (SMS) messages.
These HTTPS sites warn the prospective victim that they are using an outdated Android version and offer an APK that will allegedly update them to the latest version.
Click to expand...

Only asking for a single permission
If the user approves "downloads from unknown sources," the malware is dropped on the device and requests access to the 'Accessibility Service'.

This permission is abused to capture screenshots and keystrokes without requesting any additional permissions that would risk raising suspicions.
Click to expand...

Obfuscation and resistance to deletion
The new version of BrazKing protects internal resources by applying an XOR operation using a hardcoded key and then also encodes them with Base64.

If the user attempts to delete the malware, it quickly taps on the 'Back' or 'Home' buttons to prevent the action.
The same trick is used when the user tries to open an antivirus app, hoping to scan and remove the malware within the security tool.
Click to expand...

BrazKing's evolution shows that malware authors quickly adapt to deliver stealthier versions of their tools as Android's security tightens up.
Click to expand...

IBM X-Force: BrazKing Android Malware Upgraded and Targeting Brazilian Banks

This post provides our findings about BrazKing’s new version with insights about its dynamic mechanisms and the features that help cyber criminals use it in mobile banking fraud. As this post is written, we are seeing that BrazKing is an ongoing development and believe there will be more to come in the near future.
New BrazKing With Added Agility [...]
Click to expand...

Log in or Sign up

Android malware BrazKing returns as a stealthier banking trojan

guest Guest

Log in or Sign up

Android malware BrazKing returns as a stealthier banking trojan

guest Guest

Useful Searches