S1094: BRATA
BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]
Security context for executives and security teams
BRATA is an Android malware entry in ATT&CK associated with remote-access-style mobile capabilities and reported targeting of financial institutions. Its practical significance is that it combines mobile credential/input collection, screen capture, local data access, location awareness, web-protocol communications, and multiple evasion behaviors. For leaders, this is a reminder that mobile risk is not only device loss or phishing; compromised Android endpoints can affect banking workflows, customer or employee identity protection, fraud response, and incident evidence quality.
Executive priority
Prioritize BRATA as a mobile-banking and Android endpoint risk scenario where the organization depends on mobile access to financial, identity, or operational systems. Useful leadership questions include: Do we have visibility into managed Android devices? Can we prove which apps, permissions, accessibility-service usage, and network destinations are allowed? Are incident responders prepared to preserve mobile evidence when malware may uninstall itself or hide behavior? For regulated environments, coverage decisions should map to audit evidence for mobile device management, acceptable app sources, permission governance, phishing readiness, and detection of data exfiltration over normal web traffic.
Technical view
ATT&CK lists BRATA for Android and relates it to techniques including obfuscated files, software packing, downloading new code at runtime, keylogging, GUI input capture, security software discovery, system information discovery, location tracking, web-protocol C2, screen capture, input injection through accessibility APIs, local data collection, call control, geofencing, user evasion, disabling or modifying tools, uninstalling the malicious application, system checks, transmitted data manipulation, exfiltration over C2, matching legitimate names or locations, and phishing. SOC and IR teams should validate mobile telemetry around suspicious app installs, excessive permissions, accessibility abuse, runtime code loading, foreground screen or input capture indicators, unusual outbound web traffic, and application self-removal or security-tool interference. Because the official ATT&CK object provides no detection text, detection engineering should be technique-led rather than relying on a single BRATA-specific rule.
Likely telemetry
- Android application inventory, package names, icons, install source, and install/update timestamps
- Mobile device management or enterprise mobility management records for app allow/deny status and device posture
- Android permission grants, especially accessibility, location, phone/call, screen capture/media projection, and storage-related access where available
- Runtime indicators such as dynamic code loading or downloaded secondary code after installation
- Network telemetry for mobile devices, especially HTTP/HTTPS destinations, timing, volume, and repeated command-and-control-like patterns
Detection direction
- Build detections around the related behaviors rather than the malware name alone, especially accessibility abuse, GUI input capture, screen capture, runtime code download, and exfiltration over web protocols.
- Tune mobile-app risk scoring for applications that mimic legitimate names, icons, or package locations, request high-risk permissions, or change behavior after installation.
- Correlate phishing reports or suspicious app-install events with subsequent permission grants, location access, outbound web traffic, or security-tool discovery/tampering.
- Account for evasion blind spots: packing and obfuscation can reduce static-analysis value, runtime code download can bypass pre-publication scanning, geofencing and system checks can suppress behavior in test environments, and self-uninstall can reduce forensic artifacts.
- Separate benign administrative or accessibility use from suspicious patterns by validating business-approved apps, documented accessibility needs, managed-device baselines, and expected mobile network destinations.
Mitigation priorities
- Start with mobile governance: restrict app installation sources where feasible, maintain approved app inventories, and enforce MDM/EMM posture controls for Android devices used in business workflows.
- Harden permissions: review and limit accessibility-service use, location access, call-control permissions, storage access, and screen-capture permissions to documented business needs.
- Improve phishing resilience for mobile users, including reporting paths for suspicious links, prompts, and app installation requests.
- Require mobile incident response procedures that preserve evidence quickly, because related behaviors include uninstalling the malicious application and disabling or modifying tools.
- Use layered mobile security controls that combine app reputation, behavioral analysis, network monitoring, and device posture rather than depending only on static signatures.
Additional notes and limits
The ATT&CK record identifies BRATA as Android malware, detected in late 2018 and again in late 2021, originating in Brazil and later reported in the UK, Poland, Italy, Spain, and the USA, with believed targeting of financial institutions such as banks. The relationship set is rich and should drive defensive validation: collection, credential/input capture, evasion, C2 over web protocols, exfiltration, and anti-analysis behaviors are all represented. This take intentionally does not assert current activity, specific victims, or guaranteed detection coverage.
Official detection guidance is not provided, tactics are not specified in the supplied object, and the related technique descriptions are behavioral context rather than proof of what any specific local sample or incident will do. Local telemetry, managed-device scope, app inventory, mobile network visibility, and IR evidence are required to determine actual exposure and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
BRATA
BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 9ddc47946a43… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [2]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [3]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [4]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [5]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [6]mitre-attackS1094Open source URL
- [7]mitre-attackS1094Open source URL
- [8]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [9]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [10]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [11]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [12]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [13]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [14]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [15]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [16]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [17]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [18]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [19]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [20]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [21]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [22]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [23]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [24]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [25]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [26]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [27]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [28]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [29]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [30]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [31]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [32]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [33]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [34]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [35]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [36]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [37]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [38]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [39]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [40]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [41]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [42]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [43]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [44]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.