Full Report
An Android remote access trojan named BTMOB is offered to cybercriminals with a builder interface for generating malware payloads tailored to phishing lures. [...]
Analysis Summary
# Tool/Technique: BTMOB
## Overview
BTMOB is an advanced Android Remote Access Trojan (RAT) operated as a Malware-as-a-Service (MaaS) platform. It provides cybercriminals with a user-friendly builder interface to generate customized APK payloads tailored to specific phishing lures. The malware is primarily used for financial fraud, data exfiltration, and remote device control, with a significant operational focus on Brazil and Latin America.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Android
- **Capabilities:** Credential theft, financial transaction interception, screen capture, accessibility service abuse, and remote control.
- **First Seen:** Documentation emerged in February 2025; active through May 2026.
## MITRE ATT&CK Mapping
- **[TA0031 - Initial Access]**
- [T1474 - Supply Chain Compromise] (Via fake app stores)
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0033 - Persistence]**
- [T1624.001 - Event Triggered Execution: Accessibility Service]
- **[TA0037 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0031 - Exfiltration]**
- [T1646 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Payload Builder:** A web-based interface allowing operators to customize permissions, define app icons, and configure package names without coding.
- **Credential Theft:** Stealing specific user data and credentials from targeted applications.
- **Interception:** Capturing SMS and intercepting financial transactions to bypass 2FA.
- **Persistence:** Implementation of "Prevent Sleep Mode" and the ability to hide the application icon after installation to hinder removal.
### Advanced Features
- **Accessibility Service Abuse:** Exploits Android Accessibility Services to grant itself elevated permissions and automate UI interactions without user consent.
- **Evasion:** Features a "Disable Google Play" option and can generate localized phishing lures to increase infection rates.
- **Remote Control:** Provides operators with full remote access, including the ability to take screenshots and manipulate device settings.
## Indicators of Compromise
- **File Hashes:**
- (Specific SHA256 hashes not provided in text; analyst should monitor for recent BTMOB 2.5 samples).
- **File Names:** Various, often masquerading as streaming services, crypto-mining platforms, or government utility apps.
- **Network Indicators:**
- btmob[.]xyz (Original clearnet site)
- Private Telegram channels (Used for sales and C2 communication)
- **Behavioral Indicators:**
- Requests for Accessibility Service permissions immediately upon launch.
- Unexpected disabling of Google Play Store or Play Protect.
- App icon disappears immediately after the first execution.
## Associated Threat Actors
- **Commercialized MaaS:** Sold to various unnamed cybercriminals via Telegram for $700/month or $5,000 for a lifetime license.
- **Regional Actors:** Heavily utilized by threat actors targeting users in **Brazil, Argentina, and wider Latin America**.
## Detection Methods
- **Signature-based detection:** ESET and other vendors maintain static detection rules for SpySolr and BTMOB variants.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and subsequently attempt to disable system security features or hide their presence.
- **Heuristic Analysis:** Identifying APKs generated with common BTMOB builder artifacts (e.g., specific permission combinations and strings).
## Mitigation Strategies
- **Prevention:** Enforce a policy of installing applications only from the official Google Play Store.
- **Device Hardening:** Regularly audit "Accessibility" settings and revoke access for any unrecognized or suspicious applications.
- **Security Software:** Ensure Google Play Protect is enabled and use reputable mobile security solutions to scan for known RAT signatures.
- **User Education:** Train users to identify phishing portals that mimic Google Play or government agencies.
## Related Tools/Techniques
- **SpySolr:** The malware family from which BTMOB is believed to have evolved.
- **Accessibility Service Exploitation:** A technique common in other Android Trojans like Oscorp or Teabot.