bingomod | 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa

Analysis

max time kernel
149s
max time network
159s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
26/05/2025, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce361748bed2a8cb5e023eccb1736a17.apk
Size 22.3MB
Sample250526-hyfe7sel9t
SHA256 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa
MD5 ce361748bed2a8cb5e023eccb1736a17
SHA1 1f5e242d3ad27016099ec343a434c4166d0a951d
SHA512 c90338358399768fec43fd617c0d81142b1913f08fa86e51843a7f003e5e287d4052ecbda7a902fe50a099f0a9db5404f4732a23bc7b26ea98240f46b3238231
SSDEEP 393216:AQpO/DjWfPOaOMbU4NtdOVZw6AikcYuCP:A5DFhbyeouCP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bingomod collection credential_access defense_evasion discovery evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

bingomod

23.254.229.105

Signatures

BingoMod
BingoMod is an Android RAT first seen in May 2024.
trojan infostealer rat bingomod
Bingomod family
bingomod

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	p31e2586d.p0e6e1473.pca88ca83

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	p31e2586d.p0e6e1473.pca88ca83

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	p31e2586d.p0e6e1473.pca88ca83

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	p31e2586d.p0e6e1473.pca88ca83
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	p31e2586d.p0e6e1473.pca88ca83
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	p31e2586d.p0e6e1473.pca88ca83

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	p31e2586d.p0e6e1473.pca88ca83

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	p31e2586d.p0e6e1473.pca88ca83

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	p31e2586d.p0e6e1473.pca88ca83

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	p31e2586d.p0e6e1473.pca88ca83

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	p31e2586d.p0e6e1473.pca88ca83

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	p31e2586d.p0e6e1473.pca88ca83

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	p31e2586d.p0e6e1473.pca88ca83

p31e2586d.p0e6e1473.pca88ca83
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests allowing to install additional applications from unknown sources.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4287
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4512
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4539
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4608
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4632
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4662
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4702
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4727
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4751
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4779
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4803
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4828
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4852
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4878
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4901
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4926
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4949
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4973
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:4998
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5023
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5074
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5110
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5134
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5206
- /system/bin/ping -c 1 -W 5 104.23.191.26
  2⤵
  PID:5253