Overview

overview

10

Static

static

6

jaffacakes...91.apk

android-11-x64

7

1_ed07ab5c0d.apk

android-11-x64

10

Resubmissions

10/09/2026, 20:52

260910-znrh6agp2x10

10/09/2026, 18:49

260910-xgkqxsw1h110

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    10/09/2026, 20:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1_ed07ab5c0d.apk
  • Size 32.8MB
  • Sample260910-znrh6agp2x
  • SHA256 acfeac90095c39fd621111731467978f910b7d00da896cb07b0e7cfcb11bffd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankercollectioncredential_accessdefense_evasiondiscoveryevasionbtmobratimpactinfostealerpersistencerattrojan

Malware Config

Signatures

  • Family: BTMOBRAT

    BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.

    trojaninfostealerratbtmobrat
  • BTMOB RAT payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • responder.emitter.listener
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4826

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Persistence

        Foreground Persistence

        1
        T1541

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        2
        T1628

        User Evasion

        2
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Information Discovery

        2
        T1426

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        classes.dex
        • Path /data/data/responder.emitter.listener/app_dex/classes.dex
        • Size 1.3MB
        • SHA256 294db0fc8307a2faddf2fc594b43eea2f8c129e3a27db206343d3fe7406f888c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes2.dex
        • Path /data/data/responder.emitter.listener/app_dex/classes2.dex
        • Size 1.2MB
        • SHA256 66c861d8f8b60b94f76484ea5bcde5d9007edfa208cc7a7f6c1d6a339363c013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes3.dex
        • Path /data/data/responder.emitter.listener/app_dex/classes3.dex
        • Size 1.2MB
        • SHA256 e0ba7e6d9707e444812b60a324c290cc4c8bd3708140c11356cc6f8464e6d4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes.dex
        • Path /data/data/responder.emitter.listener/cache/classes.dex
        • Size 573KB
        • SHA256 9c5e5765d6a077bf86a3e151bfb4be5157e8c86e1d502203f607dd14b0015de5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes.zip
        • Path /data/data/responder.emitter.listener/cache/classes.zip
        • Size 1.6MB
        • SHA256 7a1d78730d2e25a46ac011d1bfbfc8d792d4d75a31378d5b083382ee054b3d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes2.dex
        • Path /data/data/responder.emitter.listener/cache/classes2.dex
        • Size 530KB
        • SHA256 c38c4ec94ec2f8daca80c2fbb4432e220d271c3121ec3684464c1209fae3093e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes3.dex
        • Path /data/data/responder.emitter.listener/cache/classes3.dex
        • Size 513KB
        • SHA256 80e7c1272ce85288bc78daa8bbb6caa88a680e9b31895c14e16900beafeab5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/responder.emitter.listener/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/responder.emitter.listener/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 a828a52b350d8beef48bf93f16bfe29381b7be3f25a21c44af145bddaf3b7dd4
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/responder.emitter.listener/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/responder.emitter.listener/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 a165abda6ee8cfc2dce1a6e8c5f012ea0a3cd340dd914a1086f7743e6415ece4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/responder.emitter.listener/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 21e62c374976ceb56a25e4251d830ec9fe43ac7b76facb0dbba3bb14e50e73fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-09-10.txt
        • Path /storage/emulated/0/IC/KSTR/2026-09-10.txt
        • Size 80B
        • SHA256 0b22c672b036570efc092f09e49c308043215d2dd739c14220f3f449e632d749
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-09-10.txt
        • Path /storage/emulated/0/IC/KSTR/2026-09-10.txt
        • Size 72B
        • SHA256 97a94a883c01b6e4a47ce64b41215cc6203019de2443f7caa623b938d5fc3c54
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-09-10.txt
        • Path /storage/emulated/0/IC/KSTR/2026-09-10.txt
        • Size 133B
        • SHA256 ad29f078f00a7352c4a62000a4da9f953b01df930e2c9eec99aed2125035d0c9
        • MD5 SHA1 SHA512 TLSH
        Submit Download