Malware
BTMOB RAT
According to Cyble, this is an advanced Android malware evolved from SpySolr that features remote control, credential theft, and data exfiltration. It spreads via phishing sites impersonating streaming services like iNat TV and fake mining platforms. The malware abuses Android’s Accessibility Service to unlock devices, log keystrokes, and automate credential theft through injections. It uses WebSocket-based C&C communication for real-time command execution and data theft. BTMOB RAT supports various malicious actions, including live screen sharing, file management, audio recording, and web injections.
Indicators of Compromise 32
Domain 110gongan[.]com Domain alcs[.]xyttkx[.]cc Domain fusu[.]us[.]ci Domain h5[.]xyttkx[.]cc Domain ls[.]j2x8a[.]top Domain s[.]orove[.]cn Domain txl[.]xyttkx[.]cc Filename ApkBuilder.php Filename Eaod29251.php Filename Eaod85401.php Filename EaodWorker.exe Filename SECRIT_KEY GitHub Repo 中国龙.zip GitHub Repo 飞鹰控打包.zip SHA-256 0376db397807c1f1e32a99a9db622f35f4fe5597bd05b4fd5e93117062e0131f SHA-256 1456f31bf6b5d4ade90fe080006478133296080353bf69c1819fa9b766e7f57a SHA-256 4395db6ad53a415532673b16f5b64207d53cecc5b15a736c038cf3890368a164 SHA-256 5dee5cde6f2874c582effe302960b21569ee007e9e0cd4f7499d418cceb9095b SHA-256 773c77494d6321e4e449c9558c7915166bcb6c05e3c42a9d30e5eac4db8ee0df SHA-256 82520e6aa6194b2de0b1c404805a5da7d3693acab8f7ae2dd5104f14baf82cd7 SHA-256 b803cd5032dc1abd7aabc45c8cadc471c8a59872a95d48807f13e230c58230f3 SHA-256 c692ad120cc90548d48dbe57d006f2403c49833b8993af3c38fe031eb39999bd SHA-256 d8a82d7b4457352774772bfac094127d7f67526ae7011d838cc3f7ccc15fd86e SHA-512 7fe8d14e7a9cda92c79d5ae836ed95d772bcc853079c4020c5213c3894c7f7af IP 108[.]187[.]7[.]66 IP 108[.]187[.]7[.]71 IP 154[.]44[.]25[.]12 IP 207[.]56[.]30[.]188 IP 207[.]56[.]30[.]194 IP 77[.]105[.]161[.]235 IP 85[.]137[.]253[.]48 Package com.icontrol.protector