recruitrat | hxxps://23997[.]cn

Analysis

max time kernel
122s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
30/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://23997.cn
Sample260430-sd2g2se16t

Score

10^/10

banker recruitrat infostealer trojan

Malware Config

Signatures

Family: RecruitRat
RecruitRat is a banking trojan first seen in 2026.
banker trojan infostealer recruitrat

Android RecruitRat payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-5.dat	family_recruitrat

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4387

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Size 20KB
SHA256 00c33fd9e5871017cb48be8f4a0a6ae2575d41911797ca61d9cab834f5b20b52
MD5 379f3ae1a1578217b822f4f532390df3
SHA1 b6ae1b8c64791dc790eb203245e32678dbc04b17
SHA512 41905aa470f68224bfced4ed7a93f68e9a839cadd98e2ede6673fee62316f5163dc5ecc2d3569f14805ba21bc8cc3224c41d1ec86f10731044dd043f65248c62
SSDEEP 384:DAYptWIFidG6+e7lIBGZsPjlrmJod8j6ezV5+lTby:btfFiOQIIIjioG6cb
TLSH
T14CA27D37EB970265F027C55426E89D0C2966C80784970BEDB97EB126C7C7F8E15E22CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pending-1778166137-ftttrv_347.apk

Path /storage/emulated/0/Download/.pending-1778166137-ftttrv_347.apk
Size 86.0MB
SHA256 f66c5dc34c8778ec58ee2b303ca118748c4c815a90d0c45fec1c4fa41d7f0eeb
MD5 a30b9135c9ab917265c3637af2151e23
SHA1 7d72dfde7762dd9af8b506b4a7d0dc6a2ba92a3f
SHA512 c8d8d513e81f56114c96d56deffe15bd94a2a2b3e74cde79c922df116300244b166311aab3981f915e51e14c9978ffaa2f4521231c4d63ae46e5ee7e8677d224
SSDEEP 1572864:idfY5m5AwdcgVjFhScmxcFQ469l1ReYC7vyNXcBvt9KtSFD/qgb2QvK97:14RFjm4t6pEYC76N0KtIyiA
TLSH
T1B41833C3EFA8681AE0F6633015746571619A1F558713E9CFA461B63CB4B3AC48B81FF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pending-1778166137-ftttrv_347.apk (deleted)

Path /storage/emulated/0/Download/.pending-1778166137-ftttrv_347.apk (deleted)
Size 520KB
SHA256 d982a9ac03f9f61c7bdce385ab238af2e3686d12c04e32ad11ef0f7110d06d7c
MD5 e9c7abdf2861aa0447b11446ef438d48
SHA1 a8ae11d2cd3bbe9fbe0dd4abad048ce5ba8ba46b
SHA512 b244e2d192f458393f9eee8e215d1211571282fa7b17d7cef6c08e8b05574f175825b7c441bb7428823d63d4725be249d96c3458ec262196afda410eec86ede9
SSDEEP 192:VNeFiZHmGZ4cxcI+0aB3o7gF2jYN8md8sw1sn4JqcU9EFzGLw:b8i3yCctCWgYym6XqPEFac
TLSH
T119B49FDB6F4B4503DA85C132893A893B02A550F36AB2DC47FBF0E91D5C68650B19F8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads