Fully equipped Spying Android RAT from Brazil: BRATA
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-3568 | Buffer Overflow RCE in WhatsApp VoIP Stack via Crafted RTCP Packets A buffer overflow (CWE-122) in the VoIP telephony stack of WhatsApp allowed a remote attacker to achieve remote code execution on a target device by sending a specially crafted series of RTCP packets to the victim's phone number. Because the flaw resided in the call-handling stack of the core app, an attacker who could reach the target's phone number over the network could gain arbitrary code execution on the device. All WhatsApp users at the time of disclosure were potentially exposed, since the vulnerable component shipped in the mainstream Meta Platforms (then Facebook) product rather than an optional add-on. The vulnerability was added to CISA's Known Exploited Vulnerability catalog on 2022-04-19, indicating confirmed real-world exploitation, and its EPSS score of 39.2% (99th percentile) signals a high likelihood of continued exploitation; no public proof-of-concept is known. It was remediated in vendor updates issued in 2019 and is widely associated with targeted espionage use (notably Pegasus spyware deployments). Do: Update WhatsApp on all mobile devices to the latest vendor release, per the CISA KEV required action; inventory your mobile fleet for outdated 2019-era builds and verify current app versions. Prioritize high-value targets (executives, journalists, government personnel) given the vulnerability's confirmed in-the-wild exploitation in espionage campaigns. No public PoC is known, but the flaw is remotely exploitable via network packets to a phone number, so treat patching as urgent. | 9.8 | 30% | KEV |
| mass≈1.5–2 billion users (effectively the entire global WhatsApp user base at the time of disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | 1d8cf2c9c12bf82bf3618becfec34ff7 | on with real-time protection enabled. Reference md5 hashes: 1d8cf2c9c12bf82bf3618becfec34ff7 4203e31024d009c55cb8b1d7a4e28064 4b99fb9de0e31004525f99c8a8 |
| md5 | 4203e31024d009c55cb8b1d7a4e28064 | led. Reference md5 hashes: 1d8cf2c9c12bf82bf3618becfec34ff7 4203e31024d009c55cb8b1d7a4e28064 4b99fb9de0e31004525f99c8a8ea6e46 To get a complete list of |
| md5 | 4b99fb9de0e31004525f99c8a8ea6e46 | c9c12bf82bf3618becfec34ff7 4203e31024d009c55cb8b1d7a4e28064 4b99fb9de0e31004525f99c8a8ea6e46 To get a complete list of IoCs along with YARA rules, pleas |
Full article533 words · extracted from securelist.com · click to collapse
“BRATA” is a new Android remote access tool malware family. We used this code name based on its description – “Brazilian RAT Android”. It exclusively targets victims in Brazil: however, theoretically it could also be used to attack any other Android user if the cybercriminals behind it want to. It has been widespread since January 2019, primarily hosted in the Google Play store, but also found in alternative unofficial Android app stores. For the malware to function correctly, it requires at least Android Lollipop 5.0 version.
The cybercriminals behind BRATA use few infection vectors. For example, they use push notifications on compromised websites; and also spread it using messages delivered via WhatsApp or SMS, and sponsored links in Google searches.
The first samples we found in the wild date to January and February 2019, while so far over 20 different variants have appeared in the Google Play Store, the majority of these pose as an update to the popular instant messaging application WhatsApp. The CVE-2019-3568 WhatsApp patch is one of the topics abused by BRATA threat actor. Once a victim’s device is infected, “BRATA” enables its keylogging feature, enhancing it with real-time streaming functionality. It uses Android’s Accessibility Service feature to interact with other applications installed on the user’s device.
| COMMAND | DESCRIPTION |
| Start/Stop Streaming | Capture and send user’s screen output in real-time. |
| Turn Off/Fake Turn Off | Can be used to turn off the screen or give the user the impression that the screen is off while performing actions in the background. |
| Device Information | Retrieves Android system information, logged user and their registered Google accounts, but missing permissions to properly execute the malware, and hardware information. |
| Request Unlock/Unlock Device | Request the user to unlock the device or perform a remote unlock. |
| Start Activity | Launch any application installed with a set of parameters sent via a JSON data file. |
| Send Text | Send a string of text to input data in textboxes. |
| Launch/Uninstall | Launch any particular application or uninstall the malware and remove traces of infection. |
It is worth mentioning that the infamous fake WhatsApp update registered over 10,000 downloads in the official Google Play Store, reaching up to 500 victims per day.
Kaspersky products detect this family as “HEUR:Backdoor.AndroidOS.Brata”
In general, we always recommend carefully review permissions any app is requesting on the device. It is also essential to install an excellent up-to-date anti-malware solution with real-time protection enabled.
Reference md5 hashes:
- 1d8cf2c9c12bf82bf3618becfec34ff7
- 4203e31024d009c55cb8b1d7a4e28064
- 4b99fb9de0e31004525f99c8a8ea6e46
To get a complete list of IoCs along with YARA rules, please visit Kaspersky Threat Intelligence Portal https://tip.kaspersky.com/
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/spying-android-rat-from-brazil-brata/92775/