Malware
BTMOB RAT
According to Cyble, this is an advanced Android malware evolved from SpySolr that features remote control, credential theft, and data exfiltration. It spreads via phishing sites impersonating streaming services like iNat TV and fake mining platforms. The malware abuses Android’s Accessibility Service to unlock devices, log keystrokes, and automate credential theft through injections. It uses WebSocket-based C&C communication for real-time command execution and data theft. BTMOB RAT supports various malicious actions, including live screen sharing, file management, audio recording, and web injections.
Indicators of Compromise 35
Domain 110gongan[.]com Domain alcs[.]xyttkx[.]cc Domain fusu[.]us[.]ci Domain h5[.]xyttkx[.]cc Domain ls[.]j2x8a[.]top Domain s[.]orove[.]cn Domain txl[.]xyttkx[.]cc Filename ApkBuilder.php Filename Eaod29251.php Filename Eaod85401.php Filename EaodWorker.exe Filename SECRIT_KEY GitHub Repo btmob GitHub Repo 中国龙.zip GitHub Repo 飞鹰控打包.zip GitHub User btmobportal GitHub User thebtmobadmin SHA-256 0376db397807c1f1e32a99a9db622f35f4fe5597bd05b4fd5e93117062e0131f SHA-256 1456f31bf6b5d4ade90fe080006478133296080353bf69c1819fa9b766e7f57a SHA-256 4395db6ad53a415532673b16f5b64207d53cecc5b15a736c038cf3890368a164 SHA-256 5dee5cde6f2874c582effe302960b21569ee007e9e0cd4f7499d418cceb9095b SHA-256 773c77494d6321e4e449c9558c7915166bcb6c05e3c42a9d30e5eac4db8ee0df SHA-256 82520e6aa6194b2de0b1c404805a5da7d3693acab8f7ae2dd5104f14baf82cd7 SHA-256 b803cd5032dc1abd7aabc45c8cadc471c8a59872a95d48807f13e230c58230f3 SHA-256 c692ad120cc90548d48dbe57d006f2403c49833b8993af3c38fe031eb39999bd SHA-256 d8a82d7b4457352774772bfac094127d7f67526ae7011d838cc3f7ccc15fd86e SHA-512 7fe8d14e7a9cda92c79d5ae836ed95d772bcc853079c4020c5213c3894c7f7af IP 108[.]187[.]7[.]66 IP 108[.]187[.]7[.]71 IP 154[.]44[.]25[.]12 IP 207[.]56[.]30[.]188 IP 207[.]56[.]30[.]194 IP 77[.]105[.]161[.]235 IP 85[.]137[.]253[.]48 Package com.icontrol.protector
MITRE ATT&CK TTPs 1
Source Articles
Inside the Underground Business of BTMOB RAT
BTMOB is an Android remote access trojan (RAT) offered as malware-as-a-service (MaaS), enabling attackers to steal data and remotely control infected devices. Initially operated as a centralized service, BTMOB's ecosystem has fragmented after the original operator sold the full source code in 2025, leading to independent resellers, counterfeit versions, and impersonators. The official operation continues to release new versions and sell access, private infrastructure, and source code, while cheaper alternatives have emerged on Telegram and underground forums, creating a decentralized and untrustworthy marketplace. This proliferation complicates attribution and increases the risk of scams and unstable or malicious variants.
bleeping-computer ·4w ago
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
The article details the discovery and analysis of a malicious Android Remote Access Tool (RAT) framework called Flying Eagle, which was leaked in early 2026 and has since been widely distributed by cybercriminal actors. The malware is distributed via fake apps impersonating Chinese government services and includes capabilities for credential theft, keylogging, screen capture, and phishing overlays. At least 170 active servers hosting the Flying Eagle infrastructure were identified, primarily in Hong Kong, using shared codebases and panel fingerprints. A new successor platform named Night Dragon has emerged, developed by the threat actor behind the @SQLRCE0 Telegram channel, indicating ongoing evolution of this mobile threat ecosystem.
static-urls