Inside BTMOB An Analytical Breakdown of a Leaked Android RAT...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.d3lab.net/inside-btmob-an-analytical-breakdown-of-a-leaked-android-rat-ecosystem/
• Blog Title: Inside BTMOB: An Analytical Breakdown of a Leaked Android RAT Ecosystem
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subsections on Accessibility-based UI automation & silent install, WebView overlay phishing, and lockscreen credential capture/replay; plus a note under Webview Attacks or Accessibility Services Abuse). Optionally cross-link from 'Generic Methodologies & Resources -> Malware Analysis' for the C2 fingerprinting/IOC pattern.

🎯 Content Summary

This post analyses a leaked, password-protected multi-package archive that exposes the full BTMOB Android RAT ecosystem. The analysts do not decrypt the ZIPs; instead, they reconstruct the platform using ZIP file headers (directory trees only), OSINT, public malware reports, and live C2 fingerprinting. Despite lacking binaries, the leak reveals a complete commercial Android RAT-as-a-Service stack: Android payload source (APK.zip), dropper APKs (Dropper.zip), a partially local builder toolkit (Bu...

🔧 Technical Details

Abusing Android Accessibility as a general-purpose automation and privilege bootstrap: a decoy app convinces the user to grant Accessibility, after which malware can inspect other apps' UI trees, read text, and inject gestures or clicks. This allows automated approval of permission dialogs, installation flows, and navigation of sensitive workflows (such as banking apps), turning user-driven checks into scriptable UI-level RCE across the device.

Two-stage Android dropper with Accessibility-assisted silent install: attackers separate a user-visible decoy APK from the real payload, embedding the second-stage APK as an asset. Once the user installs and opens the decoy and grants Accessibility, the decoy uses Accessibility to drive the system package installer, click through install/permission dialogs, and flip related settings, silently deploying and configuring the true RAT or any other second-stage payload.

Overlay/WebView injection phishing engine controlled via C2 commands: the RAT s...

🤖 Agent Actions

Summary:

• Expanded the Accessibility overlay section with a BTMOB case study that documents how brows/ject commands orchestrate C2-controlled WebView phishing kits through Accessibility overlays.
• Added a new subsection detailing Accessibility-driven multi-stage droppers that silently install embedded payloads by automating the package installer, including example code for copying and launching the second-stage APK.
• Documented distinctive BTMOB C2 fingerprints (yaarsa path grammar, JSON error body, multi-service port stack, builder coupling) and added the blog as a reference for defenders hunting these infrastructures.

Files Modified:

• src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.d3lab.net/inside-btmob-an-analytical-breakdown-of-a-leaked-android-rat-ecosystem/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subsections on Accessibility-based UI automation & silent install, WebView overlay phishing, and lockscreen credential capture/replay; plus a note under Webview Attacks or Accessibility Services Abuse). Optionally cross-link from 'Generic Methodologies & Resources -> Malware Analysis' for the C2 fingerprinting/IOC pattern.".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0