Android malware BrazKing returns as a stealthier banking trojan

​The BrazKing Android banking trojan has returned with dynamic banking overlays and a brand new implementation trick that permits it to function with out requesting dangerous permissions.

A brand new malware pattern was analyzed by IBM Trusteer researchers who discovered it outdoors the Play Retailer, on websites the place individuals find yourself after receiving smishing (SMS) messages.

These HTTPS websites warn the possible sufferer that they’re utilizing an outdated Android model and provide an APK that can allegedly replace them to the newest model.

Solely asking for a single permission

If the consumer approves “downloads from unknown sources,” the malware is dropped on the machine and requests entry to the ‘Accessibility Service’.

This permission is abused to seize screenshots and keystrokes with out requesting any further permissions that might danger elevating suspicions.

Extra particularly, the accessibility service is utilized by BrazKing for the next malicious exercise:

• Dissect the display programmatically as a substitute of taking screenshots in image format. This may be performed programmatically however on a non-rooted machine that might require the specific approval of the consumer.
• Keylogger capabilities by studying the views on the display.
• RAT capabilities—BrazKing can manipulate the goal banking utility by tapping buttons or keying textual content in.
• Learn SMS with out the ‘android.permission.READ_SMS’ permission by studying textual content messages that seem on the display. This may give actors entry to 2FA codes.
• Learn contact lists with out ‘android.permission.READ_CONTACTS’ permission by studying the contacts on the “Contacts” display.

Beginning on Android 11, Google has categorized the listing of put in apps as delicate data, so any malware that makes an attempt to fetch it’s flagged by Play Shield as malicious.

It is a new downside for all banking overlaying trojans that want to find out which financial institution apps are put in on the contaminated machine to serve matching login screens.

BrazKing now not makes use of the ‘getinstalledpackages’ API request because it used to however as a substitute makes use of the display dissection characteristic to view what apps are put in on the contaminated machine.

With regards to overlaying, BrazKing now does it with out the ‘System_Alert_Window’ permission, so it may well’t overlay a faux display on prime of the unique app as different trojans do.

As an alternative, it masses the faux display as an URL from the attacker’s server in a webview window, added from inside the accessibility service. This covers the app and all its home windows however does not pressure an exit from it.

When detecting the login to a web-based financial institution, as a substitute of displaying built-in overlays, the malware will now connect with the command and management server to obtain the proper login overlay to show.

This dynamic overlay system makes it simpler for the menace actors to steal credentials for a broader vary of banks. Serving the overlays from the attacker’s servers additionally permits them to replace the login screens as essential to coincide with adjustments on the professional banking apps or websites or add assist for brand new banks.

Obfuscation and resistance to deletion

The brand new model of BrazKing protects inner sources by making use of an XOR operation utilizing a hardcoded key after which additionally encodes them with Base64.

Analysts can shortly reverse these steps, however they nonetheless assist the malware go unnoticed when nested within the sufferer’s machine.

If the consumer makes an attempt to delete the malware, it shortly faucets on the ‘Again’ or ‘Dwelling’ buttons to forestall the motion.

The identical trick is used when the consumer tries to open an antivirus app, hoping to scan and take away the malware inside the safety software.

BrazKing’s evolution reveals that malware authors shortly adapt to ship stealthier variations of their instruments as Android’s safety tightens up.

The flexibility to grab 2FA codes, credentials, and take screenshots with out hoarding permissions makes the trojan much more potent than it was once, so be very cautious with APK downloads outdoors the Play Retailer.

In keeping with the IBM report, BrazKing seems to be operated by native menace teams, as it’s circulating on Portuguese-speaking web sites.