File name:

duanj.me.apk

Full analysis: https://app.any.run/tasks/6b43efc3-83cd-4c76-a199-4347a2d752a2
Verdict: Malicious activity
Threats:

BTMOB RAT is a remote access Trojan (RAT) designed to give attackers full control over infected devices. It targets Windows and Android endpoints. Its modular structure allows operators to tailor capabilities, making it suitable for espionage, credential theft, financial fraud, and establishing long-term footholds in corporate networks.

Malware Trends Tracker     >>>
Analysis date: March 15, 2026, 09:02:46
OS: Android 14
Tags:
btmob
rat
Indicators:
MIME: application/vnd.android.package-archive
File info: Android package (APK), with classes.dex
MD5:

54D37F09251CBE283F42F64964083CA8

SHA1:

5C9D9649B439B86CF18987865B32DAB228ACE037

SHA256:

0628AD6D1FD836B13B22E75FA169502D8CE78B7AD20F0261EB5151DA98437BCA

SSDEEP:

196608:VWaYCrD42MmgEeKcn6RhqRDovK3iTdUetUQ0DmFWZQ5uI+XpfufDoK:VW1CrDWmgOcn6fq5ordUJQnnAIkKEK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BTMOB has been detected

      • app_process64 (PID: 2869)

  • SUSPICIOUS

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2869)

    • Accesses system-level resources

      • app_process64 (PID: 2869)

    • Retrieves installed applications on device

      • app_process64 (PID: 2869)

    • Abuses foreground service for persistence

      • app_process64 (PID: 2869)

    • Creates a WakeLock to manage power state

      • app_process64 (PID: 2869)

    • Retrieves a list of running services

      • app_process64 (PID: 2869)

    • Acquires a wake lock to keep the device awake

      • app_process64 (PID: 2869)

    • Establishing a connection

      • app_process64 (PID: 2869)

    • Accesses external device storage files

      • app_process64 (PID: 2869)

    • Collects data about the device's environment (JVM version)

      • app_process64 (PID: 2869)

    • Uses encryption API functions

      • app_process64 (PID: 2869)

    • Launches a new activity

      • app_process64 (PID: 2869)

    • Intercepts events for accessibility services

      • app_process64 (PID: 2869)

    • Prevents its uninstallation by user

      • app_process64 (PID: 2869)

    • Requests access to accessibility settings

      • app_process64 (PID: 2869)

    • Overlays content on other applications

      • app_process64 (PID: 2869)

    • Checks if the device's lock screen is showing

      • app_process64 (PID: 2869)

    • Leverages accessibility to control apps

      • app_process64 (PID: 2869)

    • Checks exemption from battery optimization

      • app_process64 (PID: 2869)

  • INFO

    • Stores data using SQLite database

      • app_process64 (PID: 2869)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2869)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 2869)

    • Listens for changes in sensors

      • app_process64 (PID: 2869)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2869)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 2869)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 2869)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.apk | Android Package (54.1)
.jar | Java Archive (14.9)
.zan | BlueEyes Animation (13.9)
.vym | VYM Mind Map (12.8)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0xff49
ZipCompression: Deflated
ZipModifyDate: 2026:01:17 04:35:34
ZipCRC: 0x83c67003
ZipCompressedSize: 585568
ZipUncompressedSize: 1355036
ZipFileName: classes.dex
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2869updater.attester.responder /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2903com.android.webview:webview_service /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2905webview_zygote /system/bin/app_process32—app_process32
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
2954com.android.webview:webview_apk /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
3071com.android.systemui.accessibility.accessibilitymenu /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
87
Text files
56
Unknown types
0

Dropped files

PID
Process
Filename
Type
2869app_process64/data/data/updater.attester.responder/no_backup/androidx.work.workdb-journalbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/no_backup/androidx.work.workdb-walbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/app_webview/last-exit-infotext
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/shared_prefs/updater.attester.responder.xmlxml
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/shared_prefs/WebViewChromiumPrefs.xmlxml
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/app_webview/Default/Web Data-journalbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/app_webview/Default/Shared Dictionary/cache/indexbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/cache/WebView/Default/HTTP Cache/Code Cache/js/indexbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/cache/WebView/Default/HTTP Cache/Code Cache/wasm/indexbinary
MD5:—
SHA256:—
2869app_process64/data/data/updater.attester.responder/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-indexbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
61
TCP/UDP connections
23
DNS requests
13
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
822
app_process64
GET
204
142.250.186.68:443
https://www.google.com/generate_204
US
—
—
whitelisted
822
app_process64
GET
204
172.217.20.131:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
1756
app_process64
POST
200
142.251.173.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain
US
binary
778 b
whitelisted
1756
app_process64
POST
200
142.251.173.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:signCertificates?challenge=AAABnPC8H7kBILStY3f2ZVEBV8S493XXI0U4LB8=&request_id=8a240496-5076-43a6-ae2d-02da1371eef8
US
binary
11.8 Kb
whitelisted
2954
app_process32
POST
200
142.251.141.99:443
https://update.googleapis.com/service/update2/json
US
text
251 b
whitelisted
2954
app_process32
POST
200
142.251.141.99:443
https://update.googleapis.com/service/update2/json?cup2key=15:-_4wcRuqAhI4zO6D2rTy04BprOvI6XhWWLWFmvkPv-E&cup2hreq=7ad47fb443b5631d5778d70750da95744656f92336bf2cf0337b0db423986eb2
US
text
1.92 Kb
whitelisted
2954
app_process32
GET
200
34.104.35.123:443
https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acmmwq7dser4xm5sepzjv74g65vq_2023.7.28.10/cffplpkejcbdpfnfabnjikeicbedmifn_2023.07.28.10_all_acgbwixmcanakp2bkoppyszsbkrq.crx3
US
binary
6.71 Kb
whitelisted
2869
app_process64
POST
200
212.87.221.185:80
http://212.87.221.185/yaarsa/private/yarsap_80541.php
TR
text
8 b
malicious
2903
app_process32
GET
200
172.217.16.195:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=android_webview&milestone=137
US
compressed
14.1 Kb
whitelisted
2869
app_process64
HEAD
200
212.87.221.185:80
http://212.87.221.185/yaarsa/private/yarsap_80541.php
TR
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
142.251.36.100:80
—
GOOGLE
US
whitelisted
443
mdnsd
224.0.0.251:5353
—
—
—
whitelisted
—
—
172.217.20.131:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
142.251.36.100:443
—
GOOGLE
US
whitelisted
571
app_process64
216.239.35.0:123
time.android.com
GOOGLE
US
whitelisted
822
app_process64
142.250.186.68:443
www.google.com
GOOGLE
US
whitelisted
822
app_process64
172.217.20.131:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
1756
app_process64
142.251.173.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted
2954
app_process32
142.251.141.99:443
update.googleapis.com
GOOGLE
US
whitelisted
2954
app_process32
34.104.35.123:443
edgedl.me.gvt1.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.251.141.142
whitelisted
connectivitycheck.gstatic.com
  • 172.217.20.131
whitelisted
www.google.com
  • 142.250.186.68
whitelisted
time.android.com
  • 216.239.35.0
  • 216.239.35.4
  • 216.239.35.8
  • 216.239.35.12
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 142.251.173.81
whitelisted
update.googleapis.com
  • 142.251.141.99
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
www.zjpk.tv
  • 188.114.96.3
  • 188.114.97.3
unknown
www.svipx.cfd
  • 172.67.186.223
  • 104.21.68.53
unknown

Threats

PID
Process
Class
Message
822
app_process64
Misc activity
ET INFO Android Device Connectivity Check
2869
app_process64
A Network Trojan was detected
MALWARE [ANY.RUN] Android/Btmob activity observed in HTTP request
339
netd
Misc activity
ET INFO Observed DNS Query to .cfd TLD
339
netd
Misc activity
INFO [ANY.RUN] .cc TLD domain request
2869
app_process64
A Network Trojan was detected
MALWARE [ANY.RUN] Android/Btmob activity observed in HTTP request
2869
app_process64
A Network Trojan was detected
MALWARE [ANY.RUN] Android/Btmob activity observed in HTTP request
2869
app_process64
A Network Trojan was detected
MALWARE [ANY.RUN] Android/Btmob activity observed in HTTP request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
duanj.me.apk