| File name: | venmo.apk |
| Full analysis: | https://app.any.run/tasks/983f0753-8180-481b-a8a9-974e1c58480c |
| Verdict: | Malicious activity |
| Threats: | BTMOB RAT is a remote access Trojan (RAT) designed to give attackers full control over infected devices. It targets Windows and Android endpoints. Its modular structure allows operators to tailor capabilities, making it suitable for espionage, credential theft, financial fraud, and establishing long-term footholds in corporate networks. |
| Analysis date: | April 11, 2025, 20:34:47 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with AndroidManifest.xml |
| MD5: | 54615D15083BFAF108F07B545B20120D |
| SHA1: | 05FB8C0D5E52F33FCAD37D9F06C4F7F6531703B8 |
| SHA256: | F4E0C62BCE2AD484F42039F23614746032FD88F1319C88E7FA86789DA3F271A0 |
| SSDEEP: | 393216:6AsE32vMVabPD7KVXx4yWrudRfhgD/VkJwXJz:jJoMsbPD7KdiyWivfhgDAwB |
MALICIOUS
Initiates background APK installation
- app_process64 (PID: 2269)
Checks whether the screen is currently on
- app_process64 (PID: 2519)
Executes system commands or scripts
- app_process64 (PID: 2519)
BTMOB has been detected
- app_process64 (PID: 2519)
SUSPICIOUS
Retrieves a list of running services
- app_process64 (PID: 2519)
Creates a WakeLock to manage power state
- app_process64 (PID: 2519)
Abuses foreground service for persistence
- app_process64 (PID: 2519)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2519)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2519)
Accesses system-level resources
- app_process64 (PID: 2519)
Uses encryption API functions
- app_process64 (PID: 2519)
Connects to the server without a host name
- app_process64 (PID: 2519)
Establishing a connection
- app_process64 (PID: 2519)
Accesses external device storage files
- app_process64 (PID: 2519)
Triggers notification to user
- app_process64 (PID: 2519)
INFO
Dynamically registers broadcast event listeners
- app_process64 (PID: 2269)
- app_process64 (PID: 2519)
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2519)
Retrieves the value of a secure system setting
- app_process64 (PID: 2519)
Listens for changes in sensors
- app_process64 (PID: 2519)
Detects device power status
- app_process64 (PID: 2519)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipRequiredVersion: | - |
|---|---|
| ZipBitFlag: | 0x0808 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1981:01:01 01:01:00 |
| ZipCRC: | 0xa0a50a88 |
| ZipCompressedSize: | 2886 |
| ZipUncompressedSize: | 10288 |
| ZipFileName: | AndroidManifest.xml |
Total processes
134
Monitored processes
9
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2269 | ssecca.egdirb.tfihs.load | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2301 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2315 | webview_zygote | /system/bin/app_process32 | — | app_process32 |
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2351 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2505 | /apex/com.android.art/bin/artd | /apex/com.android.art/bin/artd | — | init |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2508 | /apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~PUf4fmcIyoktnABrjM3pvA==/yxalag.kcats.hsem-Rughu0w-XQIGysUDpxVBPg==/base.apk --oat-fd=7 --oat-location=/data/app/~~PUf4fmcIyoktnABrjM3pvA==/yxalag.kcats.hsem-Rughu0w-XQIGysUDpxVBPg==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context-fds=10 --class-loader-context=PCL[]{PCL[/system/framework/org.apache.http.legacy.jar]} --classpath-dir=/data/app/~~PUf4fmcIyoktnABrjM3pvA==/yxalag.kcats.hsem-Rughu0w-XQIGysUDpxVBPg== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:32 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:67.95.78,app-version-code:679578,art-version:340090000 | /apex/com.android.art/bin/dex2oat32 | — | artd |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2519 | yxalag.kcats.hsem | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2565 | ping -c 1 -w 15 | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 512 | ||||
| 2570 | ping -c 1 -w 15 | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 512 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
31
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/shared_prefs/WebViewChromiumPrefs.xml | xml | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/app_webview/Default/Local Storage/leveldb/MANIFEST-000001 | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/webui_js/index | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/js/index | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/app_webview/Default/Local Storage/leveldb/000001.dbtmp | text | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/app_webview/Default/Local Storage/leveldb/CURRENT | text | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index | binary | |
MD5:— | SHA256:— | |||
| 2269 | app_process64 | /data/data/ssecca.egdirb.tfihs.load/cache/WebView/Default/HTTP Cache/Code Cache/webui_js/index-dir/temp-index | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
24
DNS requests
8
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.184.228:80 | http://www.google.com/gen_204 | unknown | — | — | whitelisted |
— | — | GET | 204 | 142.250.74.195:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
— | — | GET | 204 | 142.250.184.228:443 | https://www.google.com/generate_204 | unknown | — | — | unknown |
— | — | GET | 204 | 142.250.74.195:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
2519 | app_process64 | HEAD | 200 | 79.133.57.141:80 | http://79.133.57.141/yaarsa/private/yarsap_80541.php | unknown | — | — | malicious |
2519 | app_process64 | POST | 200 | 79.133.57.141:80 | http://79.133.57.141/yaarsa/private/yarsap_80541.php | unknown | — | — | malicious |
2519 | app_process64 | POST | 200 | 79.133.57.141:80 | http://79.133.57.141/yaarsa/private/yarsap_80541.php | unknown | — | — | malicious |
2519 | app_process64 | HEAD | 200 | 79.133.57.141:80 | http://79.133.57.141/yaarsa/private/yarsap_80541.php | unknown | — | — | malicious |
— | — | GET | 200 | 142.250.185.195:443 | https://clientservices.googleapis.com/chrome-variations/seed?osname=android_webview&milestone=113 | unknown | compressed | 23.0 Kb | whitelisted |
— | — | POST | 200 | 108.177.96.81:443 | https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain | unknown | binary | 699 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
443 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 142.250.74.195:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 142.250.184.228:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.184.228:80 | www.google.com | GOOGLE | US | whitelisted |
— | — | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
— | — | 108.177.96.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
568 | app_process64 | 216.239.35.4:123 | time.android.com | — | — | whitelisted |
568 | app_process64 | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
2351 | app_process32 | 142.250.185.227:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2301 | app_process32 | 142.250.185.195:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |
— | — | Misc activity | ET INFO Android Device Connectivity Check |