General
- Target d24da9ca57c78a5640f984be2bde494efbace3026efd01075522db221aeab1bd.apk
- Size 5.6MB
- Sample260818-ngjdes1eld
- SHA256 d24da9ca57c78a5640f984be2bde494efbace3026efd01075522db221aeab1bd
- MD5 7321c6edc6475c8f67c3be8de7d30af7
- SHA1 01c7be7a2d1eb098e7daf5935f305219f8b1d6ba
- SHA512 11a1f4ada0e2de91e57baa363bc472e7eae48c5065805c3bc7f510f99c8036124ee9d6c20d401c4d0028b637aef5534e3b6ea38118096e258f1d14eb9c41cbe1
- SSDEEP 98304:CwVmqCWEX8O+ndqYE9cIpOUHUqtQpaECSq4zeG4no/Kr0BN8W1cuFOxrE/dEUC:CwV3EX8O+ni10qmY/4zeG4M8xGEUC
- TLSH T18156E0C7FB84992AD4F753B6853A936284474C268B43DBC36A18323C58B75D06F4EBC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
d24da9ca57c78a5640f984be2bde494efbace3026efd01075522db221aeab1bd.apk
Resource
android-35-x64-arm64-20260325-en
Malware Config
Targets
-
- Target d24da9ca57c78a5640f984be2bde494efbace3026efd01075522db221aeab1bd.apk
- Size 5.6MB
- SHA256 d24da9ca57c78a5640f984be2bde494efbace3026efd01075522db221aeab1bd
- MD5 7321c6edc6475c8f67c3be8de7d30af7
- SHA1 01c7be7a2d1eb098e7daf5935f305219f8b1d6ba
- SHA512 11a1f4ada0e2de91e57baa363bc472e7eae48c5065805c3bc7f510f99c8036124ee9d6c20d401c4d0028b637aef5534e3b6ea38118096e258f1d14eb9c41cbe1
- SSDEEP 98304:CwVmqCWEX8O+ndqYE9cIpOUHUqtQpaECSq4zeG4no/Kr0BN8W1cuFOxrE/dEUC:CwV3EX8O+ni10qmY/4zeG4M8xGEUC
- TLSH T18156E0C7FB84992AD4F753B6853A936284474C268B43DBC36A18323C58B75D06F4EBC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: BTMOBRAT
BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
-
Checks Android system properties for emulator presence.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Hide Artifacts
2User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Connections Discovery
1