btmobrat | beb36157df5b945561d3f6c0c2e3bfc9e334af7e0075effa4c2fe5ef0af71e13

General

Target
9854.zip
Size 16.6MB
Sample260714-yz2mtsc12k
SHA256 beb36157df5b945561d3f6c0c2e3bfc9e334af7e0075effa4c2fe5ef0af71e13
MD5 26c134b05969452e3d0902f478fd6eb8
SHA1 f387d13729c6690a3880e4db5728b2e1fbf13471
SHA512 ab49d143af4ec1723b492f58715c4881effbaa51455638198defdfaa2be2fccfbb43e13f7c0b3c72248d1835fbe897522083789cf63a09d0be04983c8b9e49d0
SSDEEP 196608:hnVvNXP3qvY0YCk9uCqfQpx8iU5LiB3ZXrjCPGjD00ipHsG4SEFzdA0xXPNPRaeQ:Jr/3qPet4QTq8XrGPG/0VHayGMeoYxV2
TLSH
T1F007337EA0E5CCA7C4B524B0E64C4FB6C979435F05B2192C0D3227B8F245971AA5BCFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  9854/FortbrasCliente.apk
- Size 7.0MB
- SHA256 52914f2a930229f506fda989359f451648cf1d4209ca5b2773c0070469c37d6f
- MD5 8c258c4861a5f2de1f3d5921ff4e1dba
- SHA1 ac186c161148c560ece540407e78b0f95d8e4f03
- SHA512 f2da3ad2a7f23e6f4598bae073d7d4c17399b09668c369d1279fbee45815a78d27b8bd39ba0cf5ee830b0347ccad658b1ee745a8c41039889654a45f480a2152
- SSDEEP 98304:ZJV+328A988E3x/D84R4eYbBfrP5k7vKRJdEFyDUq0g/oZc+45j5UFLT14ZrQI4i:+z3zp84mbBfrn41gZh9U9urKQRHrW6
- TLSH
  T10D762247EB49C96FC0BBC23A89366275150B4C1887E3875FD86DB13C287B6D08ED6E94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  childapp.apk
- Size 4.3MB
- SHA256 18c45b8db1ebec8b2b2360d64d9365d8c403dbafe03103175a30eacf00731dd0
- MD5 48b3f20b271ebc9ad6aa28f2a5255d24
- SHA1 509719fae8ae1c184a4eb26dedbc5b4f894d4a3b
- SHA512 5d2cce621914bcb405e4e289b3f4d1b17f1f155cd56c2f3440c92c48a860adce4206651dca6e43c53b9b10cd3348804a652f0ed11d0ec4c14effb9214bc4cfd2
- SSDEEP 98304:NXyY0txNdDfPQg5f5dmQ31zbiT4REc++O:UDxNdDfnL7NFe
- TLSH
  T12B26BE4BEB44DB9BC83EC1F95923797415070E2489929BDBE92C360D3D771E48EC9AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution btmobrat impact infostealer persistence rat stealth trojan
- Family: BTMOBRAT
  BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
  trojan infostealer rat btmobrat
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2
- Target
  9854/eslint.config.js
- Size 1KB
- SHA256 fa8b8fc519b1f042a88755a2459096b52b89c6f7d8c21206124aabf6787afbd7
- MD5 e45842a1f0f773f27d2adab54e1a1092
- SHA1 8dc5d5776ea14915df0dab7d9ead982399ab27e1
- SHA512 cee43c394e9a44ae07837d44867d7396134930675ebdaf82299b615d84cf64e34048cf5e10f5e4c82d873a857902e894ebe95cb3c71131dbcef4fdaec5c98073
- TLSH
  T1F0415743FA9A9C022394295B9DB55B32B13842771DAABC51F6FD12780F2C2DF697870C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  9854/index.html
- Size 9KB
- SHA256 c5db532ab8350d7d5e46dc3989be64d2f76ecf06df1e20488671f2f9322c95f1
- MD5 9b295eb660e43c9046358888b261592c
- SHA1 e3ba4ce56e74da9c39fd9a8d88e0d83aef164720
- SHA512 14104ee12335ff55d6f97c737c933aa350ad48e9816e876a66162472dfe8c36d460aa56c353626d23451787179f445e1c74f6bdf99589d4718e1b52e76cfa292
- SSDEEP 192:vBUcHBrBWLI/u6EJ5kI+oFQKm2/mckd1JgRSFLoV+:vciuZ5kIAKid35oV+
- TLSH
  T192128433A2850426257396415F91678EFAB08103D307DB497FEC2796CFF6D52C9A3B88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  9854/painel/chunk.php
- Size 4KB
- SHA256 f2bfa1e944d804ed48a9162464b897b155cec5d3e75c7bd34796bf0118b6c82e
- MD5 efb36bc6e6fb33ccba399a339e929b4e
- SHA1 7fc58a227675636dcae121fc95f4ebe0489cf556
- SHA512 ea054228dfc38af5e48e489c5ca56f4b444d6a75ca737a143c56461685611902f10754475842176b38b83bee329eb2e3e0a423c60e23e16fde7f78e0f7d0c1a6
- SSDEEP 48:psxfhhP/EY5uY4BDVz4N1NYNO0vSFDz1AR1yWSTkIvBaEmCaTFYSOlMLg+z1eQj3:ihL3kY4B54N3YZuz1AkmHa3lMLgVQpt
- TLSH
  T1E4A16546891B3563D6B3AF34AB15421BEDA18D394E366390FC7C0165AF907581FEDE0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  9854/painel/upload.php
- Size 15KB
- SHA256 b47acaf4c23ad59db8e8121a53e96f23717df56be0d18c921777b3d0dd51ede0
- MD5 aee57715094183a1a8f7a64699849bde
- SHA1 a55ca77781743c33e0b71aaf54ad5c2b4a88e50c
- SHA512 7255d4bad297e9fe1126763996b3c8d7969c45221b0bcf2a81282a0d2b2b7ee2a481d589dd752b29b93fe080cde9ad13a32f7567e10dff787f58629c09694333
- SSDEEP 192:6i3vYydN64/ZESIkfbOOKFv2kBf8BobnYbNon+MRPBqH5JbHYc0U6760g+ACVB:N3gdGukz+vzBfrYho+aPBqZZHYV6rsB
- TLSH
  T1A772E7A5895214066133D2919B828E1EFA958107DB0307897FEC215A6FF2F58D63FF8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6