<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>11/19/2021 - Diary entry #394:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>
<p>As covered in our Daily #345, Remote Access Trojan, or RAT, is a malware with capabilities to provide remote control of an infected device to an attacker. Recently, a new version of an Android banking RAT was spotted. Named BrazKing (a.k.a. DefensorID),
it targets mobile banking users in Brazil since 2020.</p>
<p><br>
</p>
<p>BrazKing is delivered by smishing (SMS messages) and its previous versions abused the accessibility permission, right after installing it, to detect launched applications by the victims. Then, when a targeted app was launched, it was shown an overlay screen
- retrieved by a hardcoded URL - on top of the legitimate app. Now, BrazKing has evolved, returning with dynamic banking overlays and a feature that enables it to operate initially without requesting suspicious permissions such as Accessibility, to avoid analysis
and detection just by installing the malware.</p>
<p><br>
</p>
<p>When installed, it requests the attacker's server, which replies asking the victim for permissions as needed during the attack. All detections are now done on the server-side, like detecting targeted apps launched. Besides RAT capabilities, BrazKing frequently
sends on-screen content to the C&C, it has a keylogging feature, and it can read contact lists or SMS messages to grab 2FA codes. All that can be done just with Accessibility, without common permissions - such as READ_SMS or READ_CONTACTS.</p>
<p><br>
</p>
<p>Since BrazKing is not on Google Play Store, it's simple to avoid this threat, by not installing apps from unofficial sources and paying attention to every permission requested.</p>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>