File name:

aok002.apk

Full analysis: https://app.any.run/tasks/bf2ea87a-2a70-4a5a-a354-fc4dba5d98bf
Verdict: Malicious activity
Threats:

BTMOB RAT is a remote access Trojan (RAT) designed to give attackers full control over infected devices. It targets Windows and Android endpoints. Its modular structure allows operators to tailor capabilities, making it suitable for espionage, credential theft, financial fraud, and establishing long-term footholds in corporate networks.

Malware Trends Tracker     >>>
Analysis date: June 06, 2025, 08:59:04
OS: Android 14
Tags:
btmob
rat
websocket
evasion
Indicators:
MIME: application/vnd.android.package-archive
File info: Android package (APK), with classes.dex
MD5:

4780B01ADD9839CC7087A16E7C5063DF

SHA1:

57DDFBEB975446AFF5ADF7471E4E81272C361953

SHA256:

C6C93111E00659CF605E9DB8ADECAFBABD73565E6F06D909062FB8064C34B931

SSDEEP:

98304:WJVuSz/j6exDZHBPWvJc/ziSw0ZpGtPN4BUhCp6VxK33SCcTy2VMO91kdY2iDz13:YCeWcHG2gTXDRtyByY4jzhEw7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Initiates background APK installation

      • app_process64 (PID: 2254)

    • Checks whether the screen is currently on

      • app_process64 (PID: 2494)

    • BTMOB has been detected

      • app_process64 (PID: 2928)
      • app_process64 (PID: 2494)

  • SUSPICIOUS

    • Abuses foreground service for persistence

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Accesses system-level resources

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Uses encryption API functions

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves a list of running services

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves installed applications on device

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Acquires a wake lock to keep the device awake

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Creates a WakeLock to manage power state

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Checks if the device's lock screen is showing

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Establishing a connection

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Returns the name of the current network operator

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Checks exemption from battery optimization

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Collects data about the device's environment (JVM version)

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Launches a new activity

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2254)
      • app_process64 (PID: 2928)

    • Requests access to accessibility settings

      • app_process64 (PID: 2494)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Overlays content on other applications

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Prevents its uninstallation by user

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Intercepts events for accessibility services

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Accesses external device storage files

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Starts a service

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves additional components with DownloadManager

      • app_process64 (PID: 2494)

    • Leverages accessibility to control apps

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Checks for external IP

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)
      • netd (PID: 342)

    • Connects to the server without a host name

      • app_process64 (PID: 2928)
      • app_process64 (PID: 2494)

  • INFO

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Stores data using SQLite database

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Listens for changes in sensors

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves the value of a global system setting

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Detects device power status

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Normally terminates current Java virtual machine

      • app_process64 (PID: 2494)

    • Gets file name without full path

      • app_process64 (PID: 2494)
      • app_process64 (PID: 2928)

    • Attempting to connect via WebSocket

      • app_process64 (PID: 2928)
      • app_process64 (PID: 2494)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.apk | Android Package (73.9)
.jar | Java Archive (20.4)
.zip | ZIP compressed archive (5.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2025:06:05 22:01:32
ZipCRC: 0xb7e10808
ZipCompressedSize: 2394977
ZipUncompressedSize: 5641692
ZipFileName: classes.dex
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
342/system/bin/netd/system/bin/netd
init
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2254lenrek.esabataD.yfitnauq /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2283com.android.webview:webview_service /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2303webview_zygote /system/bin/app_process64—app_process64
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
2338com.android.webview:webview_apk /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2494lennahc.thgisni.regnahc /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2536webview_zygote /system/bin/app_process64—app_process64
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
2625com.android.systemui.accessibility.accessibilitymenu /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2928lennahc.thgisni.regnahc /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2972webview_zygote /system/bin/app_process64—app_process64
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
261
Text files
134
Unknown types
3

Dropped files

PID
Process
Filename
Type
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/last-exit-infobinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/shared_prefs/WebViewChromiumPrefs.xmlxml
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/Default/Web Data-journalbinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/cache/WebView/font_unique_name_table.pbbinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/cache/WebView/Default/HTTP Cache/Code Cache/js/indexbinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/Default/Shared Dictionary/cache/indexbinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-indexbinary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/Default/Local Storage/leveldb/MANIFEST-000001binary
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/Default/Local Storage/leveldb/000001.dbtmptext
MD5:—
SHA256:—
2254app_process64/data/data/lenrek.esabataD.yfitnauq/app_webview/Default/Local Storage/leveldb/CURRENTtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
53
DNS requests
19
Threats
55

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2494
app_process64
HEAD
200
206.206.125.203:80
http://206.206.125.203/yaarsa/private/yarsap_80541.php
US
—
—
malicious
—
—
GET
204
142.251.140.3:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
2494
app_process64
POST
200
206.206.125.203:80
http://206.206.125.203/yaarsa/private/yarsap_80541.php
US
text
117 b
malicious
2494
app_process64
GET
101
206.206.125.203:8080
http://206.206.125.203:8080/
US
—
—
malicious
2494
app_process64
GET
200
63.35.73.24:80
http://checkip.amazonaws.com/
IE
text
13 b
whitelisted
2494
app_process64
GET
101
206.206.125.203:8080
http://206.206.125.203:8080/
US
—
—
malicious
2494
app_process64
HEAD
200
206.206.125.203:80
http://206.206.125.203/yaarsa/private/yarsap_80541.php
US
text
117 b
malicious
2494
app_process64
GET
—
63.35.73.24:80
http://checkip.amazonaws.com/
IE
—
—
whitelisted
2494
app_process64
POST
200
206.206.125.203:80
http://206.206.125.203/yaarsa/private/yarsap_80541.php
US
text
117 b
malicious
2494
app_process64
GET
200
63.35.73.24:80
http://checkip.amazonaws.com/
IE
text
13 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
446
mdnsd
224.0.0.251:5353
—
—
—
unknown
—
—
216.239.35.12:123
time.android.com
—
—
whitelisted
—
—
142.251.140.3:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
142.250.185.132:443
www.google.com
GOOGLE
US
whitelisted
—
—
142.251.168.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted
2338
app_process64
142.251.140.67:443
update.googleapis.com
GOOGLE
US
whitelisted
2283
app_process64
172.217.169.163:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
2338
app_process64
172.217.17.110:443
dl.google.com
GOOGLE
US
whitelisted
2494
app_process64
206.206.125.203:80
—
Xdeer Limited
US
malicious
2494
app_process64
63.35.73.24:80
checkip.amazonaws.com
AMAZON-02
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.185.132
whitelisted
connectivitycheck.gstatic.com
  • 142.251.140.3
whitelisted
google.com
  • 142.250.186.46
whitelisted
time.android.com
  • 216.239.35.12
  • 216.239.35.8
  • 216.239.35.4
  • 216.239.35.0
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 142.251.168.81
whitelisted
update.googleapis.com
  • 142.251.140.67
whitelisted
clientservices.googleapis.com
  • 172.217.169.163
whitelisted
dl.google.com
  • 172.217.17.110
whitelisted
checkip.amazonaws.com
  • 63.35.73.24
  • 34.252.212.161
  • 34.242.43.25
  • 54.171.248.54
  • 52.16.79.50
  • 54.216.229.77
whitelisted
www.bn.com.pe
  • 200.48.202.43
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Android Device Connectivity Check
2494
app_process64
Device Retrieving External IP Address Detected
ET INFO External IP Check (checkip .amazonaws .com)
342
netd
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)
2494
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
2494
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
2494
app_process64
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
2494
app_process64
Device Retrieving External IP Address Detected
ET INFO External IP Check (checkip .amazonaws .com)
342
netd
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2494
app_process64
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
2494
app_process64
Device Retrieving External IP Address Detected
ET INFO External IP Check (checkip .amazonaws .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
aok002.apk