Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have published a detailed analysis of Drama RAT, a multifunctional Android banking trojan equipped with remote access capabilities. The family spreads through phishing messages in messengers and masquerades as VPN services, banking applications, or cracked utilities with paid features.
All analyzed samples function as droppers. After launch, the user sees a notification about an outdated version and is prompted to install an update. Upon granting installation rights from unknown sources, the dropper sends device information and a list of installed applications to the C2 server, then downloads the main payload.
The dropper contains a library that implements C2 communication and device identification. It transmits a device fingerprint consisting of the SHA-256 hash of the concatenation of ANDROID_ID and the application signature. The server responds with the encrypted payload and part of the decryption key. The final key is assembled from the server-supplied component, a hardcoded value, and the SHA-256 hash of the dropper signature.
After decryption and installation of the payload, the trojan immediately begins exfiltrating device data including identifier, Android version, battery level, network type, wallpaper, SIM information, and granted permissions. It periodically sends heartbeat requests containing accelerometer data to confirm connectivity.
Drama RAT requests Accessibility service permission and then uses libnative_core.so to automatically grant itself additional rights to SMS, contacts, microphone, and screen recording. It overlays a black opaque block to hide the permission-granting process from the user and can draw nearly transparent images to bypass Android 12 camera and microphone indicators.
The trojan implements an extensive set of malicious functions: SMS interception and default SMS handler replacement, clipboard manipulation, browser data theft, real-time keylogging, overlay phishing, application enumeration, call spoofing, VNC screen sharing, covert microphone and camera recording, credential theft, icon hiding, notification suppression, and participation in DDoS attacks directed by the C2 server.
Communication occurs over WebSocket with mutual TLS authentication using a client certificate embedded in libnative_core.so. A fallback channel uses HTTPS requests through CDN domains. Persistence is achieved via AlarmManager alarms firing every eight seconds, Doze mode bypass, and automatic restart after device reboot.
When the user attempts to access settings to uninstall the application or revoke permissions, the malware redirects them to the home screen or main settings menu. Removal is only possible via ADB or by booting into safe mode.
The payload is protected by more than 1200 junk artifacts, deliberately corrupted AndroidManifest.xml structures, root and hooking detection, ptrace anti-debugging, and runtime string decryption that uses Base64 decoding followed by arithmetic operations with per-class keys.
Related articles
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.
Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations
Cybercriminals are increasingly misusing the legitimate Node.js runtime to execute malicious JavaScript scripts and maintain persistence on corporate networks. The technique has been observed since February 2026 against governments, technology firms, hotels, and financial organizations. Attackers favor the signed node.exe binary to evade signature-based detections after initial access via ClickFix social engineering. In one case against an Asian technology company, Node.js was deployed following blocked attempts to install AdaptixC2 and Cobalt Strike. The resulting implant establishes registry persistence and communicates with Ethereum blockchain gateways to retrieve commands hidden in smart contracts. The approach has been linked to multiple tools including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer, with some campaigns attributed to the initial-access broker Woodgnat, also known as KongTuke.
Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have identified a fresh distribution campaign for the Buhtrap RAT remote access trojan. Attackers continue to lure accountants and lawyers to counterfeit professional websites promoted through search engine advertisements. The latest lure mimics the legitimate resource Glavnaya Kniga Bukhgaltera, where visitors seeking documents instead receive a ZIP archive containing malicious payload delivered through JavaScript interception. The infection chain remains largely unchanged from prior operations, with the primary update being refreshed command-and-control infrastructure. Buhtrap has operated since 2014 as both malware and an associated criminal group; its source code leak in 2016 enabled wider adoption by financially motivated actors. Identified decoy domains include glavaudit.org, buhotchet.com, and audit24.org. Users are advised to verify site addresses carefully and avoid executing disguised EXE files.
Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu developed by the Brazilian actor Exilware. The tool maps compromised corporate networks, identifies high-value systems, and prepares access for sale to other criminals. The operation primarily targets Brazil and other countries in Latin America and the Iberian Peninsula. BraZetsu is written in Python with a modular architecture and maintains WebSocket communication with its command-and-control server. It searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. The malware also looks for Brazilian CNAB financial files, digital certificates, and browser history. Evidence suggests heavy use of generative AI during development, with an AI component on the server that may classify stolen files and prioritize valuable machines.