Analysis
- max time kernel
19s - max time network
153s - platform
android-9_x86 - resource
android-x86-arm-20250917-en - resource tags
- submitted
16/10/2025, 18:13
General
- Target p39e9fd4a.pd495b67a.p5a772ade.apk
- Size 22.4MB
- Sample251016-wt38cssnv8
- SHA256 fa5c76a8b6a12f27e81140cd84b8d9a03658d4c6d78e11f2157831a74fc74b98
Score
10/10
Malware Config
Extracted
Family
-
bingomod
C2
-
192.119.111.208
Signatures
- BingoMod
BingoMod is an Android RAT first seen in May 2024.
- Bingomod family
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Acquires the wake lock 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
p39e9fd4a.pd495b67a.p5a772ade1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
-
/system/bin/ping -c 1 -W 5 117.24.192.212⤵
-