BTMOB RAT
BTMOB RAT is a full-featured Android remote access trojan and remote administration tool. Reporting cited here states it was first identified in February 2024 as a variant of SpySolr malware, and other reporting describes it as a commodity Android RAT sold in a malware-as-a-service model and as an evolution of the CraxsRAT/CypherRAT/SpySolr ecosystem. It has been delivered in multiple Android malware campaigns, including via the MiningDropper/BeatBanker framework and through fake app download pages, phishing sites, social media links, and fraudulent websites impersonating trusted services or app stores. Observed targeting includes broader regional victims across Europe, Latin America, and Asia, and BeatBanker campaigns targeting Brazilian users; one report also notes financial-fraud-oriented deployment.
Capabilities directly described in the source material include credential harvesting and credential capture, device takeover, real-time remote control, full device control, keylogging, screen recording and screen monitoring, camera access, GPS tracking, WebView-based credential theft, data exfiltration, abuse of Android Accessibility Services, file management/handling, audio recording, command execution, and WebSocket-based remote control. The malware has also been described as facilitating financial fraud operations.
Within the analyzed MiningDropper infection chain, a trojanized Android app decrypts staged payloads, displays a fake Google Play update screen as deception, reconstructs split components, and installs a final payload such as BTMOB RAT through a third-stage installer. Recent BeatBanker iterations were reported to deploy BTMOB RAT instead of a banking module. No standalone BTMOB-specific IOC set is provided here beyond ecosystem references such as btmob[.]xyz and Telegram-based sales mentioned in one report.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Recent iterations of the campaign have been found to drop BTMOB RAT instead of the banking module."
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Collection
3 techniques
Collection
Command and Control
3 techniques
Command and Control
Cyble said that final payload can steal credentials through WebView injections, log keystrokes, exfiltrate data, abuse Accessibility Services, and support real time remote control, screen monitoring, file handling, audio recording, and command execution.
Exfiltration
2 techniques
Exfiltration
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android remote access trojan delivered by MiningDropper. The content says it can steal credentials through WebView injections, log keystrokes, exfiltrate data, abuse Accessibility Services, and support real-time remote control, screen monitoring, file handling, audio recording, and command execution.
An Android remote access trojan delivered by MiningDropper that supports credential theft, WebView-based injections, keylogging, data exfiltration, abuse of Accessibility Services, device unlocking, simulated user interaction, permission granting, file management, audio recording, and WebSocket-based real-time remote control.
Android remote access trojan used as a payload in BeatBanker campaigns; provides comprehensive remote control, persistence, and surveillance; assessed as an evolution of CraxsRAT/CypherRAT/SpySolr code lineage.
Highly obfuscated Android remote administration tool (MaaS) providing full remote control and surveillance (permission granting, silent install, persistent execution, overlays to hide notifications, credential/PIN/pattern capture, camera access, keystroke capture, GPS tracking, and real-time screen recording/streaming). Delivered as the final payload by newer BeatBanker variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.