General
- Target 026326e3b2a7533e5ae2238dcebf8c1a
- Size 6.0MB
- Sample260910-k5rg6aam2v
- SHA256 157d96e7a01cec4ef99dd7d842213ac8a52f616554271ff9ec81178b6787e123
Malware Config
Targets
-
- Target 026326e3b2a7533e5ae2238dcebf8c1a
- Size 6.0MB
- SHA256 157d96e7a01cec4ef99dd7d842213ac8a52f616554271ff9ec81178b6787e123
Score10/10-
Family: BTMOBRAT
BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Acquires the wake lock
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1