btmobrat | eafd3acdc45f2f49b1e8c7f7683f6131f67b3dd06c84e8c65159d29b0d21c1e7

Resubmissions

11/08/2026, 15:36

260811-s14kxsfa886

11/08/2026, 15:17

260811-spccasgm6110

Analysis

max time kernel
56s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
11/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 8.4MB
Sample260811-spccasgm61
SHA256 eafd3acdc45f2f49b1e8c7f7683f6131f67b3dd06c84e8c65159d29b0d21c1e7
MD5 8d836c4e5cfbe235804385bd9c092ab1
SHA1 18496c050da5e4ddab32fbe0566e2e783f725e68
SHA512 0fd7a5f8a98617d1f8ce695b0a2187c61c5d0a4d5d47e4c96133602e40a7725e52590d175fa9fabc50f2458be15be47569581b6c781c6d5ae89d192ff4cda45a
SSDEEP 196608:a2UtjR7b49TzjVL3SEf8jcjEb1oe+DuwbrBhiruzJ/b:ZUtjh49TzjV9zJe+iwbrBhiQJD
TLSH
T14B96029579000C1ED13FA27EB1DA4067459F5CCA8B77E20B5915B90A3A738ED8ADFC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access btmobrat impact infostealer rat trojan

Malware Config

Signatures

Family: BTMOBRAT
BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
trojan infostealer rat btmobrat

BTMOB RAT payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-18.dat	family_btmobrat

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	io.coral.pulse

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by in-call services to bind with the system. Allows apps to handle aspects of phone calls while they are in progress.	android.permission.BIND_INCALL_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	io.coral.pulse

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	io.coral.pulse

io.coral.pulse
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4748

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

.payload-id

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/.payload-id
Size 64B
SHA256 2025c34f2d8e991ee1cfe1034ac83608710c3e21f111ab033eea4b6fe24e1917
MD5 3c08875a6af5de13ccdf026c35c395e5
SHA1 dcc5e4bd95c5c92d7ae4f3f6750849cbd7c932e1
SHA512 bb0cb886f2ae00290e89629fd65f1e0cf51e55fcd35bfb3835be3bbd8459c1b31721000ea463df039f408cb8ac8baac21e34591b118bc027a932628cc64405b1
TLSH
T118A0228C3008ACC00282C2082038F8C320002C00CCCC8A08080AEE82300303B2AF2A08
MD5 SHA1 SHA512 TLSH

Submit Download

child.apk

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/payload/child.apk
Size 6.2MB
SHA256 a87a5919685fcc54b21a2bbdb29aa2e0c664e046fcbce6967c2d5dcc7b7e78f6
MD5 426fee80620f2eb9ccce0c3a55cc3ffd
SHA1 9bbf134c8b9de38396d256fc9b45c5e7f10d30bd
SHA512 e18410d88cf3cd848aa7b2760df0805b2b3a6ba0007a32c38065a17e5e46c7e6fd5f45f96b353149e5a8df197e1771bccac50ec191acdbae1416542368540301
SSDEEP 196608:2SV4febSqWiPoitrPQ9Wpp1rFFSzmJLMIt9:2SV4mSqW8NtDQ9K9j
TLSH
T1FA66F18AEB044D7BC8F7837100BA62A25D4F5C2D8B87D29FAC8A357D19735D04F5A6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-catalog.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/i18n-catalog.js
Size 69KB
SHA256 71b8c8d4e94f6378cfa580f9e5b5f9a6be2d6faaa86b4fbf9bee11bdaf23a4a9
MD5 e593483e946cd8f27a7f5389feb427ea
SHA1 b080abfcd5bda047ef767401b9a75553106eec5a
SHA512 7a8081cc0308d41147d00fc213822c7d3876f72a2209c2172ac67f6525bb4a9d0cf95f6bbf6fb51b0fa7a2f4b62c687ee21a9649255291c33c616d8ad76fd1b5
SSDEEP 1536:Avr8KxTwF7jvL8AxdQ0PbdaN+FfHyOFZwpC2uiKx2nQf+biH82vJC3ft9hcT:Avr8KxT6jj8AxdQARaUFPy8Zwo2uiKxL
TLSH
T142632D5BC18452306D70A384890A3520FE144ABF73225AA77CFE19D15FBB4A8E3977B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-runtime.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/i18n-runtime.js
Size 5KB
SHA256 88e7c3a649e93e2d076e84078761a64748a1558139047084132cf32dc7e9b45c
MD5 4fcbb5ab18c1185138fa69f86669d14f
SHA1 1a62a5db351edc10ef4de1aa3f633732fdb74087
SHA512 de307013a50f1ef5f56be701bff374e8baac2dc8160167ab0ddc8cf8dcd6d2afb5f797db2ca375d872c311f6423e989f04af5cdbdd759d9d5159b92d6ac6207b
SSDEEP 96:jlAoYK5ZZ7oeqXo3ZoRkXPzELKbpwxbxwvoonoEoHoPo2oXokoilNCsFtwWc/dyt:5AyNYC9XIwpwbRLwWc/dy07skh3NdN1Q
TLSH
T1DEC1DCABEC8315429134637C896B4644FD25431F015E4A43BCBDEC492FB04A972EAFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google-play.svg

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/google-play.svg
Size 1KB
SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
MD5 579b8189936bab6778bfdd8c19fc493b
SHA1 f81cfd87d033bb64c537dec8031ea542d8f22b03
SHA512 7532233d9561bdb8072beb7f97144a278f61a9c8f478c69f95434d00d34217f4aa9e3dfff7e8c540c320ee4f350714a96f5a188a1f5b7d108e338ef5e806a00d
TLSH
T10631310DA5965C3F5A72C7A462F49D8B673224C783A8C8DC85A92C3EE65C5C021BC6FD
MD5 SHA1 SHA512 TLSH

Submit Download

star-outline.svg

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/star-outline.svg
Size 278B
SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
MD5 a5feff4b1477efe7a3d525856fbcea71
SHA1 298d27aefbff453371ed0e432117fd3c0f0f1eec
SHA512 d76e3af49a883214cdba317f9e215a476e84c79c04357e3c5efc2951a49792c43fd3396289de584b64182e568487f14d1c3839ff5b358a4bb10db0e1aa14a2a5
TLSH
T15BD02B3BE0296D88477F429109B9CC8DB27D921B45DD003DC9BA514485A1AFA7B2A4BC
MD5 SHA1 SHA512 TLSH

Submit Download

star.svg

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/icons/star.svg
Size 381B
SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
MD5 fc5fd2338d246078b4a4fa29413f23e6
SHA1 52d73cabeb5e64bb9e1e024623a90a0e0cb888b6
SHA512 8abce8608cc9351440e7ec2cb624841b9357f1e6a8a9f926f4801f11b691c8cc1a2961c5c22373b677255e8ed51856932c33bfd4245ab1836c43c03a7ddb8afe
TLSH
T142E0680BCA1C6626838C0655A978B884D13F436A426E52DDEAF751106408BBFBC4EB88
MD5 SHA1 SHA512 TLSH

Submit Download

install-state.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/install-state.js
Size 9KB
SHA256 2bab299522b8e670b71c27c67348038b908807329bc8e7890644c3b62f0d2eaf
MD5 ef4174c961167cc6bf5796e6a4e37675
SHA1 b66f998e7549ba805209e646fb81bf00230d13e6
SHA512 7f32c56dcfad1aaa44a9d22f62df6630413ab0e90a081b920510bc13b79c02206e1b7de6572ad5c1564cced616ff84adf6210c49a9e3e39a58ada803977a0f03
SSDEEP 192:pbCjNkD5WkoQ/Qu80TGyo10dfoPnE74AAeDHl7pPcsOPEHr6JSFP8e:pb9x74epr6IFJ
TLSH
T10E12838BD8E714B55C17B974C14F90543E215957240DFD10BCADEA90CFC30B8A2BABEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell-web-channel.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/shared/shell-web-channel.js
Size 1KB
SHA256 e9d9d7ae0133cee912781e904c0f4a08f55cd393d4435d9189a146e74581298e
MD5 cd9fe57246945b42e35226b41e02df3b
SHA1 6f02ed9bd50ff18cc7cf5aa17c48647343395243
SHA512 4456f0a760e0bbb7f98834b39e5efe0f8ccec322fef89c44ddbd524f9685f2f66b81833d68ada985744d64fb52b8102e8ef863cf1bc38e035016921eb2b83f6d
TLSH
T1F441CF8C39D7A4194523313E1EAF88167075D103044DAEE0FBDC9374AFA552C6667FC9
MD5 SHA1 SHA512 TLSH

Submit Download

app.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/app.js
Size 4KB
SHA256 2bab6bf8758048f168908c244737ab10f4ce3fd16ceff88668b5c8a89f89b0c0
MD5 9f51dfd0ddcb68232800ae83fc1494b0
SHA1 be8602fa9652ef55cb7b66d9e5255f1ace18c795
SHA512 a866396e41d90e86832b3400a8abe515f3b59116739609b442d15d5380cd8f207d806836f715c2543c2a4a2f0c8b9e38e5beb77b8a6dda477b0a1f20ba9a88c8
SSDEEP 96:qMvxKkxAjMvh43sDhCUe+VqgL8sxEMYDFeJ0nlVWxLa7aMC:qMvxKkxAjMvu3sDh/qg48EMMFeUlVALh
TLSH
T1B09141586852147CC935B32D5B2B3288FE6741230002AA1EB4BCC89A7F76D5293FDECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.js

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/i18n.js
Size 10KB
SHA256 50d1c609c9e35a2cf7246e8757828ecfe45867af2f14c9a867d1da3a69720491
MD5 9bf1488299b4d9c6b60d5f8f2e4f7306
SHA1 5ba5a1faa066909f261afe2f1b7d9ae5e79c189f
SHA512 22fb5b300c573e8c067fc4c1f2abbc814431d4d6ea2602b142466e8ffb48585d93746fab56ec800a4be687240c782e236b2c6befd502ebb9f98e744b6549cf96
SSDEEP 192:RaVEaiYYqwT1gST4icQrK0K10Xt6ZrneAmn0BMCSwJDNuv:Ra7iYPwSST4yrtYW6FnQWMNEDNuv
TLSH
T1DC22952506CB2455C9BCA357628C3B32F5BA98BF2705A4E0BC3C91D41FBA5325324F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/index.html
Size 2KB
SHA256 4b568ab4fd8a1258d1d02ded8b4903b35a450482b726e39c54baf600b96c2bd4
MD5 7def7115a1162f33d6074de8484ee2e9
SHA1 30e4f0c1104d72cbf5358119fe71cf742b6e7563
SHA512 eaedec1b85f3d1bd69d2d63034830b11af5878ddfb4c52ea2c420e89718d5c25608c886974520ee801ea2fe9204d139f5f00416f93e2445268f6759fcc80295a
TLSH
T18E51CD1264F5A13B01A390C539A27E0EB6E5CA07CB57441532FC8AA54FF2DC9CD0756D
MD5 SHA1 SHA512 TLSH

Submit Download

style.css

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/upgrade-template/style.css
Size 10KB
SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
MD5 eff83f68b893847e5e3a6c2acd567102
SHA1 60605d2c6a4bc95f8cebe3f34c59e73e4c3c73c7
SHA512 754cee095fc66252bb6d381ff06736e2d2483a852f7a09b3c50431ed5fcae9ef881a39694ce9ddc928743fdf12fb981bcae8580772ad5c6c1389f4192728ee3b
SSDEEP 192:VArgWLXaui42Lkz7ZB4Vw61xPmN3CtYeK7cxFwAF2VL2C6Y/2LfBKFCw3YI/NxE/:4lJW1KwvQl6gboFkhgHl
TLSH
T141324312A630D57D7C3FD6BD670B5B1AB7688906090ACDED6DE8200C5FC53FB6422B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vault-config.json

Path /data/data/io.coral.pulse/cache/shell-runtime/staging/vault-config.json
Size 106B
SHA256 b80d5c19c77655040be1740356d508f9c367353b6d42118eba6891b93474b094
MD5 5a7d419220157f29f0c679901a188668
SHA1 eda9b1d2a76fd477327b3de1a7183891c6cc36a4
SHA512 701c8152b40d6334e59ef3ce1dd060f098558986154108e09bb7000a26188f95b38c8039c54e6a54869c701043a1135af5e0f2e9e53e440a4e562c9dec61786c
TLSH
T1D0B0120CC931BBD110EB134376ABD82338081412070130E87FEF080103CEA2158DFC4C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/io.coral.pulse/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 06ee470760c0e80a076cce9581e7752f4c1411d0dc377008f4e67924e123754a
MD5 5d201400bda9c87ce0d9acf985345694
SHA1 40a2752c6e7a14a95caaab5ffed9d61334438235
SHA512 7b02781d4d22ef37f076c767f089e737c45b78cad652da3060f789bdc24982486cb33e9b617c833bdca898d6a300cca65bb7f2548301a9d022ebdbef57fd5b7b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 0b6e8c0bb748b56e9c8a524be33578a66c7eb4fb9008baf6209d79dd4ffdd1c7
MD5 487cf844f35587ae399d6db4c0d4437e
SHA1 14681b261ffcf4752a4a6a38a5b40bbdef2f2ff8
SHA512 494463fd614326ffeddecef1bdbc04a69db9576370230dde391701fc178b693718bb50ff7b5d9d30b5300a458129a1bb0da70a1b2e1d1269174cd802f7b115d5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 ad423c5599150929fccd206860d7ed8245540c9303a3d374a9538f9ef427622d
MD5 1972a639f720b3f57eeca0652ebc29e3
SHA1 35e4efff9cf39de501059c71d9e64ba04f997e62
SHA512 8166d93b08f25a471ba56612563c3e7f1328856038009128c6dfc6a00a476df2aa7127eb82d6a5c4c1053874996548adfda0ccc56f1991c1204935b6c615c13c
SSDEEP 96:DUjO56+etidjnZRWzzb8/KeKcK+zSxddKz+ZD86u0ExV:DGO6tidjnfWzzb83zSxde+ZD86u0ED
TLSH
T1E0C3F08E1F692A00C8A954B1E5D00BA17D3F812F97D7E3D265A100B5EDD3921ED29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/io.coral.pulse/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8c67b93aecd59f0e597e18bcd89078a54590c3d59b1e4accca6f9124f5cadc4c
MD5 695f2fa6ab3cf9d5cfe7dcd28193c116
SHA1 5f090fdfdd9136ddf51cd344ad69ced227605c42
SHA512 766f6b9b97eb04548acbc9a25259dac3b0d7aa853c66d92627b47ebb8ee39c9231f4171537bc3d1fe65cd1caeb91ee1ab3b19e6a6011e8472cfbaabbd35c9dec
SSDEEP 6:KT8Qn6EDvl9FZde/kPlOERX4PBX4ogLugMBX4suuK+/tLAv11CW54qiOw2:KLn6EnzdeWRmBEyPbP/JwCi4TOw2
TLSH
T183722B91B3E00E53E93A0332D0C8C3050D63625B57DBCBDB66B21415EC033D87470D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/io.coral.pulse/primary.prof
Size 1KB
SHA256 3bca254fbd60efd59ac97659647ebe43bf468d732f046b973c877de73858d705
MD5 738f6ab7b59573561487ebeee58522a0
SHA1 31a2caf4a665a62c6fd77f1a5a7ad5c74e172e45
SHA512 a410e1b23f2c6a3c0a269e43b722a28f589e32127531abf68b515bb607980c2150ea6e6888b25de77781bbe1983fd1e74168a2fbc707c205c89f60362fa4e3e5
TLSH
T18A21B40C1D754AAE0AC01607C25F0E62AEEAA83C2D59124AA5E89BD265E2098BC09837
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads