Resubmissions

11/08/2026, 15:36

260811-s14kxsfa886

11/08/2026, 15:17

260811-spccasgm6110

Analysis

  • max time kernel
    23s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    11/08/2026, 15:17

General

  • Target
    app.apk
  • Size 8.4MB
  • Sample260811-spccasgm61
  • SHA256 eafd3acdc45f2f49b1e8c7f7683f6131f67b3dd06c84e8c65159d29b0d21c1e7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: BTMOBRAT

    BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.

  • BTMOB RAT payload 1 IoCs
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 4 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests dangerous framework permissions 11 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • io.coral.pulse
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:5064

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .payload-id

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/.payload-id
        • Size 64B
        • SHA256 e494bc128ed7d12db7c6a153b5cde729fff8c857b736d8e60c7e6611e196a4c5
        • MD5 SHA1 SHA512 TLSH

        child.apk

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/payload/child.apk
        • Size 6.2MB
        • SHA256 a87a5919685fcc54b21a2bbdb29aa2e0c664e046fcbce6967c2d5dcc7b7e78f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n-catalog.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/i18n-catalog.js
        • Size 69KB
        • SHA256 71b8c8d4e94f6378cfa580f9e5b5f9a6be2d6faaa86b4fbf9bee11bdaf23a4a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n-runtime.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/i18n-runtime.js
        • Size 5KB
        • SHA256 88e7c3a649e93e2d076e84078761a64748a1558139047084132cf32dc7e9b45c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google-play.svg

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/google-play.svg
        • Size 1KB
        • SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
        • MD5 SHA1 SHA512 TLSH

        star-outline.svg

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/star-outline.svg
        • Size 278B
        • SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
        • MD5 SHA1 SHA512 TLSH

        star.svg

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/star.svg
        • Size 381B
        • SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
        • MD5 SHA1 SHA512 TLSH

        install-state.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/install-state.js
        • Size 9KB
        • SHA256 2bab299522b8e670b71c27c67348038b908807329bc8e7890644c3b62f0d2eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        shell-web-channel.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/shell-web-channel.js
        • Size 1KB
        • SHA256 e9d9d7ae0133cee912781e904c0f4a08f55cd393d4435d9189a146e74581298e
        • MD5 SHA1 SHA512 TLSH

        app.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/app.js
        • Size 4KB
        • SHA256 2bab6bf8758048f168908c244737ab10f4ce3fd16ceff88668b5c8a89f89b0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n.js

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/i18n.js
        • Size 10KB
        • SHA256 50d1c609c9e35a2cf7246e8757828ecfe45867af2f14c9a867d1da3a69720491
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.html

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/index.html
        • Size 2KB
        • SHA256 4b568ab4fd8a1258d1d02ded8b4903b35a450482b726e39c54baf600b96c2bd4
        • MD5 SHA1 SHA512 TLSH

        style.css

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/style.css
        • Size 10KB
        • SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vault-config.json

        • Path /data/data/io.coral.pulse/cache/shell-runtime/staging/vault-config.json
        • Size 106B
        • SHA256 b80d5c19c77655040be1740356d508f9c367353b6d42118eba6891b93474b094
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/io.coral.pulse/files/profileInstalled
        • Size 24B
        • SHA256 c989bf95fbb5ad8078d97c1a3decfafbc38585275c33c97fa5957c8b79e758d2
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/io.coral.pulse/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 30e27c8e9dd4a092882faf797627b08cecc292ba363051a0d5d9f320717298fa
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 5fa3b3a3d74ea266531fe2e5aea3269742453e58cd5a2ee147dd5109446d0dbf
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 bbacbc6af805abe5146d58078d711d9bc566f82e53c5a0ce2615aba1ebf77525
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-wal
        • Size 124KB
        • SHA256 012cc5525027f084736d07ce8e5b56bd41c6f9ff6e6b0de103ee523ec6562674
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 cbed80f2e5c370a52432bd1af1259fbe4adf1ba2f4aba344d0a2887b6901c38d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/io.coral.pulse/primary.prof
        • Size 1KB
        • SHA256 3bca254fbd60efd59ac97659647ebe43bf468d732f046b973c877de73858d705
        • MD5 SHA1 SHA512 TLSH