BTMob is an Android remote access trojan (RAT) that uses WebSocket command-and-control (C2) communications to let attackers issue commands to infected devices in real time.
The malware is linked to the broader CraxsRAT and SpySolr ecosystem and has evolved into a commercial fraud platform designed for banking theft, device surveillance, and large-scale malicious APK distribution.
Researchers first publicly documented BTMob in February 2025 after discovering an APK named lnat-tv-pro.apk, distributed through a phishing website impersonating the Turkish iNat TV streaming service.
Later leaked source-code packages for versions 4.5.7 and 4.6 revealed a complete crimeware toolkit, including an Android payload, dropper, Windows operator panel, PHP/MySQL backend, WebSocket server, and automated APK builder.
BTMob’s WebSocket C2 Theft
BTMob connects infected Android devices to a WebSocket endpoint, commonly configured on port 8080.
Unlike a traditional polling model, where malware periodically asks a server for instructions, WebSocket communications enable a persistent two-way channel. This allows operators to send commands and receive device data with minimal delay.
The malware’s architecture includes a Node.js and Express-based WebSocket server, while its backend contains PHP handlers stored under the /yaarsa/private/ directory.
Researchers observed network patterns involving WebSocket JSON fields such as idf, sidf, cip, and itype:"Slr_client", as well as connections resembling ws://<server>:8080/con.
The C2 infrastructure can expose several services on the same host. In one documented configuration, port 80 served a default Windows IIS page, port 3000 hosted a fake “403 Forbidden” page, port 3306 exposed MySQL, port 8080 handled WebSocket traffic, and port 3389 enabled Remote Desktop Protocol access.
The fake error page is particularly useful for threat hunters. The page imitates an Apache error, claims it will redirect visitors to Google after five seconds, and has been linked to the Shodan fingerprint http.html_hash:-983012381 port:3000.
This signature can help defenders identify potential BTMob infrastructure, although further validation is required before attributing a server to the malware.
BTMob is more than a basic RAT. Its leaked source code indicates that operators can generate customized malicious APKs by selecting an application name, icon, C2 address, and permissions.
The toolkit also supports reseller functions, activation codes, cryptocurrency payments, and white-label branding.
Attackers have used phishing pages, fake Google Play Store websites, and WhatsApp-based social engineering to distribute BTMob.
In Brazil, campaigns have reportedly impersonated banks, logistics firms, streaming services, government platforms, and loyalty programs.
Some victims received convincing messages containing personal information before being persuaded through voice calls to install APK files from unknown sources, quimerax said.
Indicators of Compromise
| IOC Type | Indicator | Context |
|---|---|---|
| C2 fingerprint | http.html_hash:-983012381 port:3000 | Shodan query for the fake 403 Forbidden page served by suspected BTMob infrastructure |
| Fake 403 hash | -983012381 | HTML hash associated with the Node.js/Express decoy page on port 3000 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
 that uses WebSocket command-and-control (C2) communications to let attackers issue){kind=link}