BTMOB Exposed: Inside a Fraud-as-a-Service Platform with 1400+ live servers

The Trail

In February 2023, cryptocurrency payment processor Freewallet froze roughly $75,000 in accumulated earnings from a customer in Syria. The company demanded KYC verification. That moment of financial friction cracked the operational security that a threat actor known as EVLF had maintained for approximately eight years, and gave cybersecurity firm CYFIRMA the thread they needed to unravel one of the most prolific Android RAT operations on the market.

EVLF (also known as EvilWolf, or "EVLF DEV") had been building and selling Android remote access trojans from Syria since roughly 2015. His first publicly tracked products were CypherRAT and CraxsRAT, distributed through a surface-web shop and a Telegram channel (@craxso) that accumulated over 10,000 subscribers. Over three years, an estimated 100 or more threat actors purchased lifetime licenses. The ecosystem eventually fractured when buyers began releasing cracked versions for free, a pattern that would repeat, almost identically, with BTMOB.

The lineage from CraxsRAT to BTMOB runs through an intermediate family called SpySolr. Multiple independent analyses (Cyble, ESET, ANY.RUN, Mallory.ai) confirm that BTMOB is an evolution of SpySolr, itself derived from the CraxsRAT codebase. The architectural "DNA" is unmistakable: the same Accessibility Service abuse patterns, similar WebSocket-based C2 communication, overlapping command structures. But BTMOB represented a leap in ambition: from a general-purpose RAT to a purpose-built banking fraud platform with a professional operator experience.

When Cyble Research and Intelligence Labs (CRIL) published the first public analysis on February 12, 2025 (based on a sample discovered January 31), the malware was at version BT-v2.5. It was distributed as lnat-tv-pro.apk through a phishing site impersonating iNat TV, a Turkish streaming platform.

The C2 server resolved to hxxp://server[.]yaarsa[.]com/con. That domain, yaarsa, persists as the name of the backend directory in every leaked source package we analyzed. The entire C2 backend still lives under /yaarsa/private/, the database is still called clients, and every PHP handler still follows the yarsap_NNNNN.php naming convention established when yaarsa[.]com was the canonical server.
The infrastructure moved on. The code remembers.

Since then, BTMOB has continued to evolve. We obtained the source code packages for versions 4.5.7 and 4.6, which together comprise the full operator kit: the VB.NET operator panel (80 .vb files), the server-side APK builder pipeline (SolrStarter/SolrWorker .NET executables), the complete Android source tree (101 Java files: genuine development source, not a decompile), the dropper, and the entire C2 backend.

What the source code reveals goes beyond feature additions. It reveals a structural transformation from a centralized operation into a self-service criminal franchise, complete with a reseller API, whitelabel branding, automated APK generation, and capabilities that extend far beyond banking fraud into DDoS, cryptomining, and network exploitation.

This report traces BTMOB from its roots in a Syrian developer's earlier malware projects to its current form as a full-featured Android attack platform, and documents what the leaked source code reveals.

The Developer Speaks

EVLF operates the official Telegram account @CRAXSO and maintains a surface-web storefront at btmobrat[.]net. This storefront funnels visitors straight to Telegram: a "Join us on Telegram" button links to the operation's community of three group chats.

The FAQ message in one of the Telegram groups states that the developer of BTMOB is "EVLF (EvilWolf), owner and administrator of the official Telegram channel @CRAXSO" and that he is "exclusively present in this channel."

The FAQ also addresses a drama that speaks directly to the platform's fragmentation: an impersonator using the handle @btmobadmin reportedly bought the source code and began releasing customized versions while claiming to be the original developer. According to the FAQ, this has been ongoing for over two years. This is not an isolated incident; it's the inevitable consequence of selling source code access for a tool with an established reputation.

The Real Price of Source Code

BTMOB's pricing history reads like a startup's pivot narrative, except the product is a banking trojan.

The price trajectory tells a story of market pressure. As cracked and leaked versions proliferated, official prices plummeted. Multiple leak events accelerated the fragmentation: source packages began circulating on underground forums and Telegram channels in mid-2025, and in January 2026 BTMOB v3.6.3 source code appeared on a dark web forum. Around the same time, the v4.x packages we analyzed (containing the full backend and the complete operator kit) became available through secondary distribution channels.

From Product to Franchise

The source code reveals the exact moment the business model changed.

In btlogin.php, the HWID (Hardware ID) enforcement that once locked each operator account to a single machine is commented out. Not deleted. Commented out. The V3.2 changelog from April 13, 2025 makes it explicit: "Disabled BTMOB device hardware lock, you can now change your PC anytime."

This wasn't a bug. It was a business decision. By removing HWID binding, EVLF transformed BTMOB from a locked-down, centralized service into a portable product that buyers could run on any machine, and critically, resell.

The backend confirms the new model. A resellers table with sellerkey authentication allows third parties to create operator accounts, issue activation codes, and collect USDT cryptocurrency payments.

Today, BTMOB no longer signifies a unified operation. It's a brand name attached to a freely available codebase, operated by an unknown number of independent actors with varying levels of competence and intent.

BTMOB Lands in Brazil

Brazil has always been fertile ground for Android banking malware. With Pix (the country's instant payment system) processing over 40 billion transactions in 2025, high smartphone banking adoption, and a vibrant and fragmented cybercrime underground, the market was waiting for a tool like BTMOB.

The platform's arrival in Brazil followed the same franchise pattern visible elsewhere: local operators acquired the tool, customized it for Brazilian targets (bank overlays, Portuguese-language lures, Pix-specific flows), and distributed it to downstream buyers. ThreatFabric documented one such operator: a threat actor known as go1ano (also tracked as "go1ano Developer"), who claimed to be a "trusted partner" of both BTMOB and the GhostSpy spyware family. OSINT Industries' investigation into go1ano mapped a dual-identity pattern connecting legitimate professional activity to cybercrime operations, with domain registrations dating back to 2015 and appearances in eight data breaches between 2015 and 2025.

Go1ano is not an isolated case. Advisory pages associated with the BTMOB brand list hundreds of blacklisted accounts accused of falsely reselling the platform, a number that speaks less to effective policing and more to the scale of unauthorized distribution.

The builder ships with 14 pre-made lure templates impersonating popular apps (Netflix, WhatsApp variants, AdBlocker, Snaptube, Picsart), and the first documented sample targeted Turkish users with a fake iNat TV streaming app. But the Brazilian phishing runs deeper than templates. Observed campaigns distribute BTMOB through polished fake Google Play Store pages targeting every category: package tracking apps impersonating logistics companies like Rodonaves, banking "security modules," streaming services, utility apps. Each clone comes complete with fabricated ratings, thousands of fake reviews in Portuguese, and spoofed data safety sections.

The V3.3 changelog (April 2025) added Spanish and Portuguese accessibility pages, and the dropper includes localization for seven languages: EN, AR, ZH, TR, PT, RU, ES. The Arabic-first localization and right-to-left UI support in the earliest versions are consistent with EVLF's Syrian origin; Portuguese was a later addition driven by market demand.

Under the Hood

BTMOB is not a single piece of malware. It's a platform with five interlocking components, all running on a single Windows host under XAMPP.

The APK payload (101 Java files, genuine Android Studio source, not a decompile) is the RAT installed on victim phones. The dropper is a weaponized fork of Shelter, an open-source app that abuses Android's Work Profile for isolation. The VB.NET panel (BTMob.exe) is the operator's desktop console. The C2 backend (PHP, MySQL, Node.js) handles 45 endpoints under /yaarsa/private/. And the APK builder (SolrStarter.exe/SolrWorker.exe) is a template-based pipeline: operators fill in a form (app name, icon, C2 address, permissions) and the server produces a ready-to-distribute APK. No development knowledge required.

The design is monolithic by today's standards, but operationally simple: one server, one install, everything works. The target customer is a fraud operator, not a DevOps engineer.

Hunting

The leaked source code gives defenders something interesting: exact knowledge of what a C2 server looks like from the outside, before ever touching a live host. Hit the server's root URL and you see what looks like a misconfigured Apache installation: a fake 403 Forbidden page with a JavaScript redirect to google[.]com after five seconds. The actual operational endpoints are buried under /yaarsa/private/.

The Fake 403

In yaarsa/server/websocket-server.js, the blocksmg constant defines 18 lines of HTML: a page titled 403 Forbidden with the message "Redirecting in 5 seconds..." and a JavaScript redirect to google[.]com after 5 seconds. The same page is served at the Node.js root route on port 3000. Near-identical copies appear in yaarsa/index.php and yaarsa/user/login.php, with one difference: their JavaScript timer fires in 1 millisecond instead of 5 seconds, despite displaying the same "5 seconds" text.

From Source Code to Live Infrastructure

Internet scanning platforms like Shodan, FOFA, Censys, ZoomEye, and Hunter index HTTP responses from every reachable host. Each platform computes its own response fingerprints (Shodan uses html_hash, FOFA uses body_hash, Censys indexes full response bodies), and all of them capture the same raw HTML. The same fake 403 page that exists in the source code is searchable across every major scanning platform.

We used Shodan's html_hash to demonstrate the approach, but the underlying pattern (the fake 403 HTML, the port combination, the IIS default page) is platform-agnostic.

Port 80 on most BTMOB C2 servers shows the default Windows Server IIS welcome page. This happens because the install guide instructs operators to deploy on Windows Server using XAMPP, but never tells them to disable the IIS service that runs by default. The result is two web servers on the same host: IIS answering port 80 with its stock welcome page, and Apache handling the actual C2 application on other ports.

Port 3000 is the exposed flank. The Node.js/Express server serves the fake 403 page at its root route, mimicking a default Apache error and a redirect to google[.]com after 5 seconds.

The fake 403 page on port 3000 produces the html_hash value -983012381. Searching Shodan:

http.html_hash:-983012381 port:3000

This returned 1,402 hosts. The vast majority of them serve the exact HTML defined in the source code: an HTML 2.0 DOCTYPE mimicking an Apache error, <title>403 Forbidden</title>, "Redirecting in 5 seconds...", and a JavaScript redirect to google[.]com.

Confirming the Match

Among the 1,402 results, we manually verified several hosts and confirmed they are running the full BTMOB stack. The confirmed C2 servers share a consistent port signature. Visiting each port on a confirmed host 77[.]111[.]101[.]24 reveals the full stack:

The database and remote access layers are equally visible. MySQL on port 3306 responds to external connections, and the WebSocket server on port 8080 reveals itself with a 426 Upgrade Required when accessed over plain HTTP:

The Bypass Factory

While scanning Shodan results for BTMOB C2 servers, we noticed several hosts with an unexpected page title: "painel de controle elite." These weren't C2 panels. They were something else entirely. A dedicated dork confirmed the pattern:

html:"painel de controle elite"

This returned 19 hosts, mostly in Brazil, all running a shared platform called "Painel de Controle Elite". The service runs typically on port 5000, and offers a straightforward workflow: an operator uploads a malicious APK, the service processes it to evade Google Play Protect, and returns a modified APK ready for distribution.

The operational security matches the sophistication you'd expect from a drag-and-drop bypass service: the default credentials are admin:admin123, and most operators never change them. The same login works across multiple live instances, a detail that says less about the platform's security and more about who is running it.

Each operator rebrands the same platform with their own name. At the time of writing, the following instances were live:

The panel exposes the full pipeline:

• APK upload and processing: operators drag and drop an APK, the service modifies it and returns a bypassed version.
• Reseller management: operators can onboard sub-users, track their build history, and revoke access.

This is not a RAT command-and-control server. It is the supply chain layer that sits between a RAT builder like BTMOB and the victim's phone: build the APK, upload it here, receive a Play Protect-clean version, push it in many places. The "BT Bypass Rat" instance confirms this platform is being used in the BTMOB ecosystem.

These are only the instances indexed under one shared panel name. The bypass-as-a-service model is generic: any operator can deploy their own instance with a different title, making the visible 19 hosts a lower bound.

RADAR: Build, Inject, Sign, Distribute

A separate platform we identified during our research operates under the name RADAR: a self-described "sistema de processamento Android" (Android processing system) hosted at playstoreapps[.]pro.

RADAR automates the entire APK weaponization pipeline. An operator uploads a clean APK, and the system handles the rest through seven stages: extract, decode with apktool, prepare the helper, inject the payload, recompile, sign with a keystore, and deliver the final package. The build log streams in real time. No technical knowledge required, the platform says so itself.

The admin panel, accessible with factory-default credentials that were never changed, reveals the operational scale: three active accounts, two at "VIP Elite" tier, and nine builds processed on the day we observed it. The platform supports user management with tiered access, build quotas, and invite-based onboarding, the same franchise infrastructure pattern we've seen throughout this ecosystem.

The app list inside the panel shows what these operators are building: package-tracking lures (Jadlog, Movimente Express), health insurance (Amil), loyalty programs (Livelo), government services (MeuINSS), and generic configuration prompts, all tailored to Brazilian targets.

Nine builds in a single day, from a platform with three accounts and default credentials. The barrier between "I want to run a campaign" and "I have a signed, weaponized APK" is a drag and a drop.

A Real-World Delivery, Observed

During an incident response engagement, we observed a BTMOB operator targeting customers of a major Brazilian retail chain. The attack chain was a multi-stage social engineering operation delivered entirely through WhatsApp, combining automated messaging with live voice interaction, a level of operational sophistication that goes well beyond a mass-phishing blast.

Stage 1: Precision Targeting

The initial contact arrived via WhatsApp from a profile configured with the retailer's official branding and logo. The message, formatted as an "Assistente Virtual" (Virtual Assistant), opened by displaying the victim's full name, membership number, national ID (CPF), date of birth, phone number, and current plan tier, all accurate.

This level of precision suggests access to previously compromised databases or data aggregated from multiple Brazilian breach dumps. The effect is immediate: seeing your own data quoted back at you by what looks like an official channel erases skepticism before it forms.

Stage 2: The Offer

The message then presented a fake loyalty upgrade, a premium tier with fabricated benefits: five free years, a 20% discount on partner stores, and priority access to offers. The victim was given a binary choice: (1) Accept or (2) Decline. An internal reference code (IFBM0I) was embedded in the message, suggesting the operator runs a campaign-tracking system across victims.

The structure mirrors a legitimate customer-service interaction so closely that declining feels like opting out of a real benefit.

Stage 3: The Call, Then the Payload

After the victim accepted, the "Virtual Assistant" announced that an attendant would call to "activate" the new plan. A six-minute voice call followed. This is the critical step. The call serves three purposes: it humanizes the interaction, it gives the operator a chance to walk the victim through enabling "unknown sources" on their Android device, and it creates enough urgency to push the victim past any remaining hesitation.

Minutes after the call ended, a 4.1 MB .apk file was delivered directly via WhatsApp. Once installed through sideloading, the dropper initiated the BTMOB RAT infection cycle.

What This Shows

This is not a spray-and-pray campaign. The operator had the victim's real data before contact, used a spoofed brand identity, ran a scripted social engineering flow with a reference-tracking system, deployed a live caller to handle objections and enable sideloading, and delivered the payload through WhatsApp, a channel most security tools don't inspect. Each stage was designed to erode one more layer of doubt.

A Different Vector: The Fake Play Store

During our research into BTMOB delivery mechanisms, we identified a second distribution channel operating alongside the WhatsApp campaigns: a near-perfect clone of the Google Play Store hosted at playstoreap[.]lovable[.]app.

The site replicates the Play Store's layout, branding, and install flow, serving spoofed pages for popular Brazilian apps: Nubank, TikTok, and even a fake Gov.BR government service. Each page displays fabricated ratings and download counts to build trust, though the cracks are visible: zero reviews, no descriptions, and every app categorized as "Other."

The store's landing page reveals the operator's full inventory, including a GhostNFC entry, an NFC relay tool from the same Brazilian fraud ecosystem where BTMOB circulates.

The hosting is worth noting: lovable[.]app is a legitimate app-building platform, giving the clone a valid TLS certificate and a clean domain reputation. A victim sees a padlock, a .app domain, and a green install button. Nothing to flag. Following our research, the QuimeraX team reported the site to Lovable's Trust & Safety team, and the fake store was taken down.

What This Means

BTMOB is not exceptional because of any single capability. Every feature it offers exists in other malware families. What makes it significant is the completeness of the package and the business model wrapped around it.

From a single developer in Syria building CypherRAT for a Telegram audience of script kiddies, to a source-code-available franchise with reseller APIs, USDT payments, automated APK generation, and third-party contributors adding bank-specific bypasses, BTMOB's evolution mirrors the professionalization of the broader cybercrime ecosystem. The developer doesn't need to attack banks. The developer sells the tools, collects subscriptions, and lets a growing network of independent operators handle the risk.

For defenders, the implications are clear. Domain-based blocking fails because there is no single C2 domain; each operator runs their own infrastructure. The same IOCs appear across unrelated campaigns because crypto constants, wire delimiters, signing keys, and User-Agent strings are baked into the source code and shared by all operators. And the source code is freely available, which means the barrier to entry is a YouTube tutorial and a Windows VM.

The good news: BTMOB's crypto scheme hasn't changed since v2.5. The testkey signing is a reliable anchor. The yarsap_* naming convention and yaarsa/ directory structure are stable.

The platform will continue to fragment. More variants, more operators, more regional adaptations. But the "DNA" is identifiable. You know what to look for.

BTMOB is one campaign. The ecosystem behind it is much larger

Malware families, leaked source code, reseller networks, and exposed infrastructure are constantly reshaping the threat landscape. QuimeraX helps organizations uncover these connections, track the actors behind them, and turn fragmented signals into actionable intelligence.

If you want to understand which threats are targeting your organization and what infrastructure, actors, and campaigns are connected to them, talk to QuimeraX.

→ Talk to our Threat Intelligence team

Indicators of Compromise

Infrastructure Fingerprints

Network Indicators

Domains

IPs

Note: The IP listed above is one confirmed example. The Shodan query http.html_hash:-983012381 port:3000 returned 1,402 hosts at the time of writing. Use the queries in the Infrastructure Fingerprints table above to find current results.

C2 Backend Paths