Zimperium Analyzes Four Android Banking Trojan Campaigns Targeting 800+ Apps
Summary
Zimperium zLabs investigated RecruitRat, SaferRat, Astrinox, and Massiv, four Android banking trojan campaigns targeting over 800 banking, cryptocurrency, and social media apps. The research details their delivery, evasion, credential theft, and C2 techniques.
Key points
- The research identifies RecruitRat, SaferRat, Astrinox (also known as Mirax), and Massiv, targeting over 800 banking, cryptocurrency, and social media applications.
- Campaigns use phishing and social-engineering lures to deliver APK droppers that stage secondary payloads.
- The malware abuses Android's Session Installation API and Accessibility Services to install payloads, grant permissions, obscure activity, and resist removal.
- Observed evasion includes APK ZIP-structure tampering, encrypted payloads and strings, runtime loading, and checks for rooted or analysis environments.
- Credential theft methods include phishing overlays, fake lock screens, keylogging, and interception of clipboard, notification, and SMS data, including 2FA codes.
- All four families can stream screen content using MediaProjection; their C2 communications use HTTPS or WebSockets, with RecruitRat adding RC4 encryption.
Article Details
- Attack Vectors
- Phishing sites offering fake recruitment opportunities, streaming access, or app updates distribute malicious Android APKs.
- Smishing messages may use spoofed sender IDs and link to phishing sites or direct APK downloads.
- Dropper APKs use the Session Installation API to stage hidden secondary payloads.
- Accessibility abuse and deceptive overlays enable credential capture, permission granting, and interference with uninstall attempts.
- Malicious overlays imitate target apps and lock screens; the malware can also use MediaProjection to stream device screens to its infrastructure.
- Defensive Notes
- Zimperium says its Mobile Threat Defense web protection blocks traffic to the malicious domains and phishing infrastructure described in the research.
- Zimperium says its detection identifies behaviors including unauthorized Accessibility Services use, covert MediaProjection screen sharing, and sideloading of secondary payloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xhire[.]cc | Astrinox phishing and APK-distribution domain; the article says it serves Android visitors a download prompt. |
MITRE ATT&CK
T1406.002RecruitRat and SaferRat tamper with APK ZIP structures, while the families also encrypt strings or payloads to hinder analysis.T1414Clipboard interception is identified among the campaigns' credential and token collection capabilities.T1417.001Three analyzed families use Accessibility APIs to capture keystrokes and credentials entered in targeted apps.T1417.002The malware presents phishing overlays over targeted apps and fake lock screens to capture visible credentials and PINs.T1418SaferRat and Massiv enumerate installed applications with PackageManager; RecruitRat also discovers launcher apps and exfiltrates the app list.T1453The malware abuses Accessibility Services to grant permissions, intercept interactions, and support credential theft.T1481.002Astrinox uses a persistent WebSocket connection to communicate with its C2 and exfiltrate installed-app telemetry.T1513All four analyzed families use MediaProjection and VirtualDisplay to stream device screen content to attacker infrastructure.T1516SaferRat uses automated navigation to redirect users attempting to reach its app-management page; the article also describes remote clicks and gesture simulations.T1517The article reports interception of SMS and notification content, including OTPs used for 2FA.T1624.001The article reports that malware creates broadcast receivers to react to SMS events.T1626.001The article's technique table attributes device-administrator capabilities to malware, including resetting device credentials and disabling the lockscreen.T1646The campaigns send collected data, including app inventories, keystroke telemetry, and screen content, to attacker C2 infrastructure.T1655.001SaferRat disguises a dropper as a Google Play Store update, and the campaigns use fake app and system-update interfaces.T1660The campaigns use phishing websites, including xhire[.]cc, to lure victims into downloading malicious APKs.
Malware
Astrinoxa surge in Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications usingMassivin Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications using sophisticated C2Miraxtracked four active Android banking trojan campaigns—RecruitRat, SaferRat, Astrinox (also identified as Mirax), and Massiv—targeting over 800 applications across banking, crypto, and social media verticals.RecruitRatzLabs identified a surge in Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications usingSaferRatzLabs identified a surge in Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications using
Vendors
Products
AndroidzLabs identified a surge in Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications usingGoogle Play StoreA primary example of this multi-stage strategy is observed in SaferRat, which utilizes a dropper meticulously disguised as a Google Play Store update (Figure 6).Mobile Runtime Protection (zDefend)However, Zimperium customers—utilizing both Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend)—remain protected against these evolving adversarial techniques.Mobile Threat DefenseHowever, Zimperium customers—utilizing both Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend)—remain protected against these evolving adversarial techniques.
Tools
apktoolremains resilient to these structural anomalies during execution, standard analysis tools (such as APKTool or JADX) frequently crash or fail to decompress the AndroidManifest.xml, effectively blinding automatedjadxresilient to these structural anomalies during execution, standard analysis tools (such as APKTool or JADX) frequently crash or fail to decompress the AndroidManifest.xml, effectively blinding automated security
Industries
BankingzLabs identified a surge in Android banking trojan activity across four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications usingCryptocurrencyacross four distinct campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications using sophisticated C2 frameworks and multi-stage payloads.Social mediacampaigns—RecruitRat, SaferRat, Astrinox, and Massiv—targeting over 800 banking, cryptocurrency, and social media applications using sophisticated C2 frameworks and multi-stage payloads.