Android/Trojan.Spy.Brat

Short bio

Android/Trojan.Spy.Brat is Malwarebytes’ detection name for a family of Android Remote Access Tools of Brazilian origin.

Source and type of infection

Links to the malware are spread by SMS. These are usually accompanied with social engineering tactics to convince victims to install the malware. Once the malware is active on the victims’ device the fraudsters can now remotely hijack the device whenever they want to, and can perform banking transactions without the target knowing. Not only that, the app can be used to initiate admin-level actions, such as locking the screen, changing the screen lock, and setting password rules. Some variants will also perform a factory reset, which will keep the victim busy an distracted.

Aftermath

Android/Trojan.Spy.Brat is a remote access tool (RAT) which is specialized in banking fraud. Some variants are capable of removing anti-virus apps.

Protection

Malwarebytes for Android protects against Android/Trojan.Spy.Brat.

Remediation

These apps can be uninstalled using the mobile devices uninstall functionality, but these apps will be made available under different names. That is where Malwarebytes for Android can help you, by identifying these apps and removing them.

Associated threats

• Android/Trojan.Agent.PWSCR
• Android/Trojan.Spy.Agent.GPPSSATB
• Android/Trojan.Spy.Brat.dsa
• Android/Trojan.Spy.Brat.gvmb
• Android/Trojan.Spy.Brat.oupa
• Android/Trojan.Spy.Brat.prta
• Android/Trojan.Spy.SpyNote.dcnp