bingomod | fa5c76a8b6a12f27e81140cd84b8d9a03658d4c6d78e11f2157831a74fc74b98

Analysis

max time kernel
149s
max time network
154s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
16/10/2025, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p39e9fd4a.pd495b67a.p5a772ade.apk
Size 22.4MB
Sample251016-wt38cssnv8
SHA256 fa5c76a8b6a12f27e81140cd84b8d9a03658d4c6d78e11f2157831a74fc74b98
MD5 73ff2caf65b10fe0d9c862d23fc76a04
SHA1 4fd2d5f87bb6d83534683050a15a846120deb290
SHA512 a0e4394c484f2624d47232ad60fbab4cbad2ccb90d89d4ef947d2b3c6549f077acdc6e43b4cea1ad5c955e7f80856d359b3129ad9179fd6b61e7318bd260e1a7
SSDEEP 393216:FJSVXJTbHbrP+pA7YNmdOVZw6AikcYuCe:7SVXxPdReouCe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access defense_evasion discovery evasion bingomod impact infostealer persistence rat trojan

Malware Config

Extracted

Family

bingomod

192.119.111.208

Signatures

BingoMod
BingoMod is an Android RAT first seen in May 2024.
trojan infostealer rat bingomod
Bingomod family
bingomod

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	p39e9fd4a.pd495b67a.p5a772ade

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	p39e9fd4a.pd495b67a.p5a772ade

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	p39e9fd4a.pd495b67a.p5a772ade

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	p39e9fd4a.pd495b67a.p5a772ade

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	p39e9fd4a.pd495b67a.p5a772ade

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	p39e9fd4a.pd495b67a.p5a772ade

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	p39e9fd4a.pd495b67a.p5a772ade

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	p39e9fd4a.pd495b67a.p5a772ade

p39e9fd4a.pd495b67a.p5a772ade
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5016
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5304
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5332
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5366
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5392
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5430
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5470
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5491
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5515
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5539
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5561
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5581
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5604
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5625
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5649
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5670
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5692
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5714
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5738
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5758
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5781
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5804
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5830
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5850
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5872
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5896
- /system/bin/ping -c 1 -W 5 117.24.192.21
  2⤵
  PID:5920