Malware analysis https://site.golesyapro.site/?utm_source=tiktok&utm_medium=paid&utm_id=1850859175001234&utm_campaign=GOLESYA%2003%20TESTE&ttclid=E_C_P_CoACygtuirO90kgTONszyYGQ7nGTwxTWWp7c4I4ANt4yAQ2JXZh5FW-lu3Z4NSJ5tZ79hbKcOB5E3xEoLeKzXY2LABBtpVHU35XDMRLSIwvHL3_mgKTnLkClpdGx2KAuxOFKBrY1-yN6ieYAYvZsOmHmbPPIt91WRF8eAf_n0dtYT2-5QYp4HUDS6isl57uvST5ZPk2xjUsjkLlwVdH82ebS8h8m4nDxB7-BifqX2O0f3LGpB_wNxgrI8bVvU1Y93a1FKh4dbEEohCMTe8lmi-LYLeYDjq3zqVmLkhWxfs5pSDDiTSU0yEEujt4Dtvpm5Hm5mCdlOBksAsLLWkC2sLpPNxIEdjIuMA Malicious activity

Add for printing

URL:	https://site.golesyapro.site/?utm_source=tiktok&utm_medium=paid&utm_id=1850859175001234&utm_campaign=GOLESYA%2003%20TESTE&ttclid=E_C_P_CoACygtuirO90kgTONszyYGQ7nGTwxTWWp7c4I4ANt4yAQ2JXZh5FW-lu3Z4NSJ5tZ79hbKcOB5E3xEoLeKzXY2LABBtpVHU35XDMRLSIwvHL3_mgKTnLkClpdGx2KAuxOFKBrY1-yN6ieYAYvZsOmHmbPPIt91WRF8eAf_n0dtYT2-5QYp4HUDS6isl57uvST5ZPk2xjUsjkLlwVdH82ebS8h8m4nDxB7-BifqX2O0f3LGpB_wNxgrI8bVvU1Y93a1FKh4dbEEohCMTe8lmi-LYLeYDjq3zqVmLkhWxfs5pSDDiTSU0yEEujt4Dtvpm5Hm5mCdlOBksAsLLWkC2sLpPNxIEdjIuMA
Full analysis:	https://app.any.run/tasks/85cb27be-2073-4f9c-9cd8-5a3b8a1d8550
Verdict:	Malicious activity
Threats:	BTMOB RAT is a remote access Trojan (RAT) designed to give attackers full control over infected devices. It targets Windows and Android endpoints. Its modular structure allows operators to tailor capabilities, making it suitable for espionage, credential theft, financial fraud, and establishing long-term footholds in corporate networks. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	December 14, 2025, 17:33:23
OS:	Android 14
Tags:	btmob rat evasion websocket
Indicators:
MD5:	029CACD8A82EEB931D7228997E650C25
SHA1:	FA675CE516E1106C171654EA9041B188614BC648
SHA256:	C6199E175FB988CBBEACDF0F5ACDF9ED83F5BDAAE5C95B7A6C27EE72CD11B0B1
SSDEEP:	12:2klA5imaQtg+62W0FvCPWBDsNr7WilwTCaI+9oI8wTLj:2klOqW+2xFxBDs5Wilm1I+9V8wXj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (14)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Initiates background APK installation
  - app_process64 (PID: 4378)
- BTMOB has been detected
  - app_process64 (PID: 4475)
- Checks whether the screen is currently on
  - app_process64 (PID: 4475)
SUSPICIOUS
- Accesses system-level resources
  - app_process64 (PID: 4475)
- Abuses foreground service for persistence
  - app_process64 (PID: 4475)
- Retrieves installed applications on device
  - app_process64 (PID: 4475)
- Retrieves a list of running services
  - app_process64 (PID: 4475)
- Retrieves Android OS build information
  - app_process64 (PID: 4475)
- Overlays content on other applications
  - app_process64 (PID: 4475)
- Checks for external IP
  - netd (PID: 347)
  - app_process64 (PID: 4475)
- Checks if the device's lock screen is showing
  - app_process64 (PID: 4475)
- Establishing a connection
  - app_process64 (PID: 4475)
- Prevents its uninstallation by user
  - app_process64 (PID: 4475)
- Uses encryption API functions
  - app_process64 (PID: 4475)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 4475)
- Creates a WakeLock to manage power state
  - app_process64 (PID: 4475)
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 4475)
- Acquires a wake lock to keep the device awake
  - app_process64 (PID: 4475)
- Requests access to accessibility settings
  - app_process64 (PID: 4475)
- Launches a new activity
  - app_process64 (PID: 4475)
- Intercepts events for accessibility services
  - app_process64 (PID: 4475)
- Returns the name of the current network operator
  - app_process64 (PID: 4475)
- Accesses external device storage files
  - app_process64 (PID: 4475)
- Starts a service
  - app_process64 (PID: 4475)
- Connects to unusual port
  - app_process64 (PID: 4475)
- Leverages accessibility to control apps
  - app_process64 (PID: 4475)
INFO
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 4378)
  - app_process64 (PID: 4475)
- Stores data using SQLite database
  - app_process64 (PID: 4475)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 4475)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 4475)
- Listens for changes in sensors
  - app_process64 (PID: 4475)
- Retrieves the value of a secure system setting
  - app_process64 (PID: 4475)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 4475)
- Gets file name without full path
  - app_process64 (PID: 4475)
- Retrieves the value of a global system setting
  - app_process64 (PID: 4475)
- Detects device power status
  - app_process64 (PID: 4475)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

158

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
347	/system/bin/netd	/system/bin/netd		init
User: root Integrity Level: UNKNOWN Exit code: 0
3962	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4014	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4025	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
4053	com.android.traceur	/system/bin/app_process64	—	app_process64
User: u0_a54 Integrity Level: UNKNOWN Exit code: 512
4065	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4067	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4139	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
4164	com.android.providers.partnerbookmarks	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4216	/system/bin/dmesgd	/system/bin/dmesgd	—	init
User: dmesgd Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

1 032

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4378	app_process64	/data/user/0/ggg.ggg/cache/oat_primary/arm64/base.4378.tmp		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/no_backup/androidx.work.workdb-journal		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/shared_prefs/com.mobitech.scanner.xml		xml
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/no_backup/androidx.work.workdb-wal		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/app_webview/last-exit-info		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/shared_prefs/WebViewChromiumPrefs.xml		xml
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/app_webview/Default/Web Data-journal		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/app_webview/Default/Shared Dictionary/cache/index		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/app_webview/Default/Shared Dictionary/cache/index-dir/temp-index		binary
		MD5:—	SHA256:—
4475	app_process64	/data/data/com.mobitech.scanner/app_webview/Default/Local Storage/leveldb/MANIFEST-000001		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

282

TCP/UDP connections

401

DNS requests

232

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3962	app_process64	GET	302	104.26.2.143:443	https://cdn.tailwindcss.com/	US	—	—	whitelisted
1921	app_process64	GET	204	142.250.185.196:443	https://www.google.com/generate_204	US	—	—	whitelisted
3962	app_process64	GET	200	147.93.37.231:443	https://site.golesyapro.site/?utm_source=tiktok	CY	html	1.59 Kb	unknown
1921	app_process64	GET	204	142.250.186.163:80	http://connectivitycheck.gstatic.com/generate_204	US	—	—	whitelisted
3962	app_process64	GET	200	216.58.206.78:80	http://clients2.google.com/time/1/current?cup2key=9:lnfHnTvcKeU8wDdwB2NX4Ra52e8v_l1ij4Yn7h04F9I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	104 b	whitelisted
—	—	GET	204	142.250.185.196:80	http://www.google.com/gen_204	US	—	—	whitelisted
3962	app_process64	GET	200	147.93.37.231:443	https://site.golesyapro.site/play.png	CY	image	115 Kb	unknown
2931	app_process64	POST	200	142.250.27.129:443	https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain	US	binary	778 b	whitelisted
3962	app_process64	POST	204	216.239.34.36:443	https://region1.google-analytics.com/g/collect?v=2&tid=G-C13E58ST8H&gtm=45je5ca1v9230051551za200zd9230051551&_p=1765733623292&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=389190920.1765733623&ul=en-us&sr=1024x576&uaa=&uab=&uafvl=Chromium%3B137.0.7122.0%7CNot%252FA)Brand%3B24.0.0.0&uamb=1&uam=V50_ThinQ&uap=Android&uapv=14.0.0&uaw=0&are=1&frm=0&pscdl=&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391252~115583767~115938465~115938468~116184927~116184929~116217636~116217638~116251938~116251940~116744866&sid=1765733623&sct=1&seg=0&dl=https%3A%2F%2Fgolesyapro.site%2F&dr=https%3A%2F%2Fsite.golesyapro.site%2F&dt=Golesya%20Pro%20-%20App%20de%20Resultados%20de%20F%C3%BAtbol%20%7C%20Descarga%20APK&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1025	US	—	—	whitelisted
3962	app_process64	GET	200	104.26.2.143:443	https://cdn.tailwindcss.com/3.4.17	US	binary	128 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
452	mdnsd	224.0.0.251:5353	—	—	—	whitelisted
—	—	142.250.185.196:80	www.google.com	GOOGLE	US	whitelisted
—	—	142.250.186.163:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
—	—	142.250.185.196:443	www.google.com	GOOGLE	US	whitelisted
3962	app_process64	216.58.206.78:80	clients2.google.com	GOOGLE	US	whitelisted
3962	app_process64	147.93.37.231:443	site.golesyapro.site	AS-HOSTINGER	CY	unknown
3962	app_process64	142.250.185.196:443	www.google.com	GOOGLE	US	whitelisted
3962	app_process64	64.233.167.84:443	accounts.google.com	GOOGLE	US	whitelisted
3962	app_process64	104.26.2.143:443	cdn.tailwindcss.com	CLOUDFLARENET	US	whitelisted
1921	app_process64	142.250.186.163:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.185.110	whitelisted
www.google.com	142.250.185.196	whitelisted
clients2.google.com	216.58.206.78	whitelisted
site.golesyapro.site	147.93.37.231	unknown
accounts.google.com	64.233.167.84 64.233.166.84	whitelisted
cdn.tailwindcss.com	104.26.2.143 172.67.68.11 104.26.3.143	whitelisted
connectivitycheck.gstatic.com	142.250.186.163	whitelisted
time.android.com	216.239.35.0 216.239.35.4 216.239.35.8 216.239.35.12	whitelisted
staging-remoteprovisioning.sandbox.googleapis.com	142.250.27.129	whitelisted
golesyapro.site	147.93.37.231	unknown

Threats

PID	Process	Class	Message
1921	app_process64	Misc activity	ET INFO Android Device Connectivity Check
3962	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3962	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
347	netd	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)
4475	app_process64	Device Retrieving External IP Address Detected	ET INFO External IP Check (checkip .amazonaws .com)
4475	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Websocket Upgrade Request
4475	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Websocket Upgrade Request
4475	app_process64	Device Retrieving External IP Address Detected	SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
347	netd	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
347	netd	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to sentry .io

Add for printing

No debug info

General Info

029CACD8A82EEB931D7228997E650C25

FA675CE516E1106C171654EA9041B188614BC648

C6199E175FB988CBBEACDF0F5ACDF9ED83F5BDAAE5C95B7A6C27EE72CD11B0B1

12:2klA5imaQtg+62W0FvCPWBDsNr7WilwTCaI+9oI8wTLj:2klOqW+2xFxBDs5Wilm1I+9V8wXj

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Initiates background APK installation

BTMOB has been detected

Checks whether the screen is currently on

SUSPICIOUS

Accesses system-level resources

Abuses foreground service for persistence

Retrieves installed applications on device

Retrieves a list of running services

Retrieves Android OS build information

Overlays content on other applications

Checks for external IP

Checks if the device's lock screen is showing

Establishing a connection

Prevents its uninstallation by user

Uses encryption API functions

Updates data in the storage of application settings (SharedPreferences)

Creates a WakeLock to manage power state

Collects data about the device's environment (JVM version)

Acquires a wake lock to keep the device awake

Requests access to accessibility settings

Launches a new activity

Intercepts events for accessibility services

Returns the name of the current network operator

Accesses external device storage files

Starts a service

Connects to unusual port

Leverages accessibility to control apps

INFO

Dynamically registers broadcast event listeners

Stores data using SQLite database

Dynamically inspects or modifies classes, methods, and fields at runtime

Retrieves data from storage of application settings (SharedPreferences)

Listens for changes in sensors

Retrieves the value of a secure system setting

Verifies whether the device is connected to the internet

Gets file name without full path

Retrieves the value of a global system setting

Detects device power status

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings