Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

BTMOB: A stealthy RAT burrowing deep into Android devices The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise BTMOB: A stealthy RAT burrowing deep into Android devices Award-winning news, views, and insight from the ESET security community English Español Deutsch Português Français TIPS & ADVICE BUSINESS SECURITY ESET RESEARCH About ESET Research Blogposts Podcasts White papers Threat reports WeLiv…

https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices

sha256:df0e8c00bca0e28a8c81a64c9a157077a96fcc6b915181078b36f575fd7c764a

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv421
ipv60
sha10
domain16
sha25636
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	74.125.202.103	Open →
ip	142.251.183.138	Open →
ip	173.194.193.138	Open →
ip	173.194.206.106	Open →
ip	178.156.177.192	Open →
ip	191.101.131.250	Open →
ip

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports