General
- Target ce361748bed2a8cb5e023eccb1736a17.apk
- Size 22.3MB
- Sample250526-hyfe7sel9t
- SHA256 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa
- MD5 ce361748bed2a8cb5e023eccb1736a17
- SHA1 1f5e242d3ad27016099ec343a434c4166d0a951d
- SHA512 c90338358399768fec43fd617c0d81142b1913f08fa86e51843a7f003e5e287d4052ecbda7a902fe50a099f0a9db5404f4732a23bc7b26ea98240f46b3238231
- SSDEEP 393216:AQpO/DjWfPOaOMbU4NtdOVZw6AikcYuCP:A5DFhbyeouCP
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
ce361748bed2a8cb5e023eccb1736a17.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
ce361748bed2a8cb5e023eccb1736a17.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
ce361748bed2a8cb5e023eccb1736a17.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral4
Sample
bnl.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
bnl.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
bnl.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral7
Sample
hibank.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral8
Sample
hibank.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral9
Sample
hibank.apk
Resource
android-x64-arm64-20240910-en
Malware Config
Extracted
-
bingomod
-
23.254.229.105
Targets
-
- Target ce361748bed2a8cb5e023eccb1736a17.apk
- Size 22.3MB
- SHA256 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa
- MD5 ce361748bed2a8cb5e023eccb1736a17
- SHA1 1f5e242d3ad27016099ec343a434c4166d0a951d
- SHA512 c90338358399768fec43fd617c0d81142b1913f08fa86e51843a7f003e5e287d4052ecbda7a902fe50a099f0a9db5404f4732a23bc7b26ea98240f46b3238231
- SSDEEP 393216:AQpO/DjWfPOaOMbU4NtdOVZw6AikcYuCP:A5DFhbyeouCP
- MD5 SHA1 SHA512 SSDEEP
Bingomod family
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
Queries the mobile country code (MCC)
Requests allowing to install additional applications from unknown sources.
Requests disabling of battery optimizations (often used to enable hiding in the background).
Requests modifying system settings.
-
- Target bnl.apk
- Size 5.2MB
- SHA256 90b8cf2581f3c10280f6351a101855b15e19ac3045e6a758a03d57719298d105
- MD5 9d0294a16cde2febdbd7aef859c7fc8b
- SHA1 82e28e00a80187baf020ef3afbbaca6f19555e82
- SHA512 233a1b43657b14a00f9ae71e6e244e16ad7d4bee81ce00c2f06a824fe130079d2ed300afd911fea5cbfc115a6b6242e6e1901d23db4a282320aebdb1aad439e7
- SSDEEP 98304:5tvemxMTKAXhaIc6Lx2LIvREdA+aONYXa6llRhwAHB6L33PyVvxYC+ATPwFPXwVV:PvemyvgLM6dwONYXa4RDHBYUvxYTTFPe
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target hibank.apk
- Size 5.1MB
- SHA256 8d5422d1756415d0cc6a087870f46f9e8f4290ee681a48700a702da38d7806c3
- MD5 ab16f0a62bb447076a83bcd2d897f940
- SHA1 face2eb39ebb4fb06a8360eb8909ac421ab7f28f
- SHA512 861a077c07d5be3c5e9356a2a74bee22524f4da18b1d92429168881f0225e92df86c89c21df1e588da5de3aa5f702dfc025ddaa62cff5e4dda566c7886670467
- SSDEEP 98304:a7V2/NhFNfLjkg1ttUO3z/ButMfjPoZ6Uq+xuA3KykBtuheMySaPwFPX+eX:a7OrfUSsOzB/jW66ayNhS2FPXPX
- MD5 SHA1 SHA512 SSDEEP
Score1/10
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1