# BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale

> A February 2026 leak of the BTMob Android remote access trojan's source code on underground forums, including Breach Forums, weakened the original developers' control and allowed independent actors to modify and resell it. BTMob offers live screen monitoring and remote control, SMS/call interception, camera/microphone/GPS access, keylogging, credential capture and silent app installation.

- **Published:** 2026-11-05T21:18:12Z
- **Last reviewed:** 2026-11-05T21:18:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5346
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5346.png
- **ID:** TL-2026-5346
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** EVLF (Syria)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

BTMob (BTMOB RAT) is a malware-as-a-service Android remote access trojan first released in late 2024 and publicly analysed from February 2025. It descends from the SpySolr family and shares lineage with CraxsRAT and CypherRAT, which are attributed to the Syria-based developer EVLF; the operator control panel displays 'BTMOB BY EVLF'. Flashpoint describes a toolkit with components in VB.NET, Java, Node.js, PHP, MySQL, HTML, CSS and JavaScript.

Flashpoint reports that in February 2026 BTMob source code leaked on underground forums including Breach Forums, weakening the original developers' control over distribution and letting other actors obtain, modify and resell it. The resulting ecosystem is fragmented: competing 'legitimate' and modified builds, disputes over authenticity, and allegations that some packages embed malicious code that compromises other criminals. Named actors in Flashpoint's reporting include H7TEEN Anon (developer, Telegram promotion, demo video 2026-03-15), S1mp1y Ducky and ME8TE3N (credited on v4.0), DaarkShop/GhostKernel (primary seller via Crax Shop, distributing payload-creation tutorials), V0id.Ade1r/PriceAde1r/Sparticus (reverse engineer and reseller), Owl (claimed BTMob 4.0 development on 2026-03-29) and R H (advertised a free seven-day trial in April 2026). Distribution channels include Telegram channels (Crax Shop, FP CC CHECK, Reverse Engineering Lab Discussion, SH GROUP, Indian Hackers) and Breach Forums.

Technical analysis by third parties (D3Lab, Quimerax, Aviatrix, Flare) of leaked packages describes heavy abuse of the Android Accessibility Service for UI automation, gesture injection, PIN/pattern replay and silent installation of a second-stage payload from a decoy dropper APK; HTML phishing overlays injected through an invisible WebView for banking credential theft; and screen capture via the MediaProjection API. The backend is an HTTP/WebSocket hybrid: a PHP/MySQL panel under /yaarsa/ paths and a Node.js WebSocket server on port 8080 (ws://<host>:8080/con) exchanging JSON with fields idf, sidf, cip and itype 'Slr_client'. Quimerax fingerprinted about 1,400 exposed C2 hosts through a Node.js decoy page on port 3000 (Shodan http.html_hash -983012381). Delivery described by those sources is phishing pages and fake Play Store sites impersonating banks, logistics and streaming services, with a heavy Brazilian focus (Pix targeting, Portuguese lures); this regional targeting and infrastructure detail comes from the third-party reports, not from Flashpoint, which states no C2, hashes or regional targeting.

Pricing cited by third parties fell steadily: subscriptions of $700/month and $3,000 lifetime in early 2025, source code at $20,000 in May 2025, and secondary-market lifetime access of $500-$1,500 and source code of $1,500-$2,000 by 2026. Source-version dating differs between reports (Flashpoint cites v4.0 on 2025-01-25; others place v4 in Dec 2025, v4.1 Feb 2026, v4.5 Apr 2026, and leaked source for v3.6/v3.6.3/v4.5.7/v4.6), so defenders should treat version numbers as indicative. No CVE is involved; severity is an analyst judgment from capability and proliferation. BeaconBeagle could not be queried for the one network IOC (HTTP 502), so no C2 correlation is recorded.

## MITRE ATT&CK

- T1660 Phishing
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1628.001 Hide Artifacts: Suppress Application Icon
- T1406 Obfuscated Files or Information
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1418 Software Discovery
- T1516 Input Injection
- T1513 Screen Capture
- T1512 Video Capture
- T1429 Audio Capture
- T1430 Location Tracking
- T1636.004 Protected User Data: SMS Messages
- T1437.001 Application Layer Protocol: Web Protocols
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BTMob Android RAT - Lure, Storefront and C2 Infrastructure Access via Proxy** (`TL-2026-5346-SPL-001`)

Detects web proxy traffic from users and managed devices to infrastructure tied to the BTMob (BTMOB RAT) ecosystem: the fake Play Store page, Rodonaves tracking lure, fake banking module host, APK processing platform, official storefront, the confirmed C2 IP 77.111.101.24 and the sample lnat-tv-pro.apk dropper. Phishing-delivered sideloading is the first step of BTMob infection (T1660).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1660, T1655.001
- **Data sources:** proxy:pan:url, palo_alto_url_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype="pan:url" earliest=-24h
```BTMob TL-2026-5346: lure/storefront domains, confirmed C2 IP and sample APK name```
| eval host_l=lower(coalesce(url_domain, url))
| where match(host_l, "(^|[./])(btmobrat[.]net|playstoreapps[.]pro|playstoreap[.]lovable[.]app|rastrear-encomendas2[.]pages[.]dev|meusdownloads[.]site)") OR dest_ip="77.111.101.24" OR like(lower(url), "%lnat-tv-pro.apk%")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(http_user_agent) as user_agents by src_ip user dest_ip
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where tolower(RequestURL) matches regex @'(^|[./])(btmobrat\.net|playstoreapps\.pro|playstoreap\.lovable\.app|rastrear-encomendas2\.pages\.dev|meusdownloads\.site)' or DestinationIP == '77.111.101.24' or tolower(RequestURL) contains 'lnat-tv-pro.apk'
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 20) by SourceIP, SourceUserName, DestinationIP
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationIP, Hits, Urls
```

### Sigma

```yaml
title: BTMob Android RAT Lure and C2 Infrastructure Access via Proxy
id: 5b1c7a52-3e0d-4a6f-9a41-6f2d8c1b7e01
status: experimental
description: Detects proxy requests to domains, an IP and an APK filename associated with the BTMob (BTMOB RAT) Android RAT ecosystem (TL-2026-5346).
references:
    - https://flashpoint.io/blog/inside-btmob-how-a-source-code-leak-expanded-access-to-a-mobile-rat/
    - https://blog.quimerax.com/btmob-exposed-inside-a-fraud-as-a-service-platform-with-1400-live-servers/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial_access
    - attack.t1660
    - attack.defense_evasion
    - attack.t1655.001
    - attack.tool.btmob
logsource:
    category: proxy
detection:
    selection_domain:
        cs-host|endswith:
            - 'btmobrat.net'
            - 'playstoreapps.pro'
            - 'playstoreap.lovable.app'
            - 'rastrear-encomendas2.pages.dev'
            - 'meusdownloads.site'
    selection_ip:
        cs-host: '77.111.101.24'
    selection_apk:
        c-uri|contains: 'lnat-tv-pro.apk'
    condition: 1 of selection_*
falsepositives:
    - Threat researchers or security staff visiting the infrastructure
    - Security awareness exercises that reference the lure domains
level: high
```

**Known false positives:**

- Security researchers or SOC analysts browsing the listed domains for investigation
- Phishing-awareness simulations that reuse the lure domains or the sample APK name

**Tuning notes:** Change index/sourcetype to your web proxy feed (pan:url shown). Exclude research/sandbox subnets by src_ip. Domains on shared platforms (lovable.app, pages.dev) are matched only at the exact BTMob-linked hostname; add new hostnames from threat updates. Note the IOC context says the C2 IP is not platform-verified, so treat a lone hit as high-priority triage rather than confirmed compromise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Android APK Sideload Download from Non-Store Host (BTMob Dropper Delivery) (locked: unlock with TL Creds)
- BTMob / SpySolr / CraxsRAT Family Alerts and Android RAT Technique Evidence in Defender (locked: unlock with TL Creds)
- BTMob WebSocket C2 - Persistent Port 8080 /con Sessions from Mobile Clients (locked: unlock with TL Creds)
- BTMob Ecosystem Domain Resolution (Lure, Storefront and APK Platform) (locked: unlock with TL Creds)
- Android Alert for SMS, Overlay, Keylogging or Screen-Capture Abuse by Accessibility Service (BTMob Behaviours) (locked: unlock with TL Creds)
- BTMob C2 Host Contact - Confirmed C2 IP, Node.js Decoy Port 3000 and WebSocket Port 8080 (locked: unlock with TL Creds)
- BTMob Android RAT - Sideloaded App with Accessibility Service Enabled and Hidden Launcher Icon (locked: unlock with TL Creds)
- BTMob Android RAT - C2 Panel /yaarsa/ Paths and WebSocket Server Components (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `77.111.101[.]24`
- Domain: `btmobrat[.]net`
- Domain: `playstoreapps[.]pro`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Inside BTMob: How a Source Code Leak Expanded Access to a Mobile RAT](https://flashpoint.io/blog/inside-btmob-how-a-source-code-leak-expanded-access-to-a-mobile-rat/)
- [Inside the Underground Business of BTMOB RAT (Flare, sponsored content)](https://www.bleepingcomputer.com/news/security/inside-the-underground-business-of-btmob-rat/)
- [BTMOB Android RAT 2025 (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/btmob-android-rat-2025)
- [BTMOB Exposed: Inside a Fraud-as-a-Service Platform with 1400+ live servers (Quimerax)](https://blog.quimerax.com/btmob-exposed-inside-a-fraud-as-a-service-platform-with-1400-live-servers/)
- [Inside BTMOB: An Analytical Breakdown of a Leaked Android RAT Ecosystem (D3Lab)](https://d3lab.net/inside-btmob-an-analytical-breakdown-of-a-leaked-android-rat-ecosystem)
- [BTMob Uses WebSocket C2 for Real-Time Android Command Execution and Data Theft (Cyberpress)](https://cyberpress.org/btmobs-websocket-c2-theft/)
- [Android-троян BTMOB RAT приходит под видом софта для стриминга и майнинга (Anti-Malware.ru)](https://www.anti-malware.ru/news/2025-02-13-114534/45267)
- [Unmasking EVLF DEV - The Creator of CypherRAT and CraxsRAT (CYFIRMA)](https://www.cyfirma.com/?p=19069)
- [BTMOB RAT malware family profile](https://awake-2ts.pages.dev/malware/families/btmob/)
- [BTMOB, el troyano de acceso remoto que avanza en la región (WeLiveSecurity)](https://www.welivesecurity.com/es/malware/btmob-el-troyano-de-acceso-remoto-que-avanza-en-la-region/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5346