MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BTMobRat


Vendor detections: 10


Intelligence 10 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1
SHA3-384 hash: dafee293e5ff15247ab1ea46be4dbb31a056531ce75ee3a00c643de9871e5147e742cb9cbf65c1a8d3f46a23b62fa49c
SHA1 hash: 1fff999fddab7c075963e09a0f1155ed76981794
MD5 hash: 7bd987f93ce191a3bc8f7590ffe510ff
humanhash: crazy-wolfram-football-lithium
File name:8e8fd0cc41163bccb6013ac5967bd4613cb2ee6e0829f1a9340eca1d299c91d7
Download: download sample
Signature BTMobRat
Create hunting rule
File size:11'639'808 bytes
First seen:2026-08-04 18:23:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 98304:9ukOR43/jppH6wrHA2poBkx5uHTs1DsLHyM59kGudh1NxtHWvhud:BH6wjpAG5uHgOx9kGYhjfHW5u
TLSH T138C64847B2A69439D4970B304C3A951E9BF4BE0ECB1D8D8AB28FFC645732375751B20A
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 32f0ccccd4f032b2 (1 x RedLineStealer, 1 x BTMobRat)
Reporter johnk3r
Tags:BTMob BtmobRAT exe xred xred-mooo-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-04 18:29:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f227db04-ad17-4394-9ee8-382c50d2983a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78828/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 crypto fingerprint overlay packed packed reconnaissance vbnet
Link:
https://www.filescan.io/uploads/6a722e60aefdb70ac700497c/reports/3d63ed31-8289-4cc6-bd63-dd58d0326a49/overview
Verdict:
Malicious
Labled as:
Capa_detect_VM_via_motherboard_hardware_WMI_queries
Link:
https://www.hybrid-analysis.com/sample/c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-04T14:54:00Z UTC
Last seen:
2026-08-06T10:18:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a9c492f0-26c5-4ce7-84a2-a13a70890db0
Result
Threat name:
n/a
Detection:
malicious
Classification:
mine
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1952206
Signature
Antivirus / Scanner detection for submitted sample
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
50%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1
Verdict:
inconclusive
YARA:
13 match(es)
Tags:
.Net Executable Html Javascript in Html Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.46 SVG Win 32 Exe x86
Link:
https://app.malva.re/file/7bd987f93ce191a3bc8f7590ffe510ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1/
Threat name:
Win32.Trojan.BTMobRat
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 18:25:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
386
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykyhrk35s26nwbq4gtvyrygvqh7sxciuvqtkwi3omn3v5ptzjhiq._file
Result
Malware family:
btmob_win
Create hunting rule
Score:
  10/10
Tags:
family:btmob_win discovery rat
Link:
https://tria.ge/reports/260804-w2awsabq9z/
Behaviour
System Location Discovery: System Language Discovery
Detects BTMOB RAT
Family: BTMOB
Unpacked files
SH256 hash:
c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1
MD5 hash:
7bd987f93ce191a3bc8f7590ffe510ff
SHA1 hash:
1fff999fddab7c075963e09a0f1155ed76981794
Link:
https://www.unpac.me/results/ff27a7e3-d093-462e-b61a-2a23f99780a1/
SH256 hash:
d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
MD5 hash:
ed5a809dc0024d83cbab4fb9933d598d
SHA1 hash:
0bc5a82327f8641d9287101e4cc7041af20bad57
Link:
https://www.unpac.me/results/ff27a7e3-d093-462e-b61a-2a23f99780a1/
SH256 hash:
348179b6593cf255bed4f79df4f298a8d449230f596ae033e29f5d28647803b7
MD5 hash:
34a0a9c969b16e1dd2790fcc18158649
SHA1 hash:
ba72918e44ba8b9e351de5619e206f04dbd2fddd
Link:
https://www.unpac.me/results/ff27a7e3-d093-462e-b61a-2a23f99780a1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang
Create hunting rule
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:win_dotnet_vb_stealer_rat
Create hunting rule
Author:Arrbat
Description:Detects .NET/VB executables with stealer/RAT capabilities (sockets, HTTP, processes, registry, etc).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78828/

Comments