Add Indicators of compromise for the BTMOB Android RAT

[nimrod-a]

Adds Indicators of compromise for the BTMOB Android RAT.

A total of 163 indicators:

• 23 IPs (C2, infrastructure)
• 8 domains (delivery, C2)
• 132 SHA256 (BTMOB samples, both payloads and droppers)

Sources

• ESET: https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/
• Cyble Research: https://cyble.com/blog/btmob-rat-newly-discovered-android-malware/
• ANY.RUN: https://any.run/malware-trends/btmob/
• ThreatFox: https://threatfox.abuse.ch/browse/tag/BTMOB/
• Zimperium: https://github.com/Zimperium/IOC/tree/master/2025-04-BTMOB-RAT
• MalwareBazaar: https://bazaar.abuse.ch/browse.php?search=tag%3ABTMOB

Since some of the samples are available online, it might be useful to check for recurring patterns (paths, assets etc.) that would enable more general IoCs, since infrastructure and sample indicators frequently change.

Closes #44

[besendorf]

Thanks for the contribution — the bundle and catalog entry look good overall.

One minor data-quality issue: sha256.txt contains the same SHA-256 twice, once uppercase and once lowercase (lines 63–64). The generator treats these as distinct strings, so the STIX bundle also carries duplicate semantic indicators. Please remove one and update the stated count to 162 unique IOCs.

[nimrod-a]

Thank you for the review. Removed the duplicate hash!

[nimrod-a]

Since indicators.yaml was updated via #46 it needs to be adjusted to avoid merge conflict

[nimrod-a]

@besendorf is anything missing from the IoCs?
The quality issue and IoC count in the description was resolved, as well as the indicators.yaml merge conflict :)