General
- Target p39e9fd4a.pd495b67a.p5a772ade.apk
- Size 22.4MB
- Sample251016-wvew6aay2e
- SHA256 fa5c76a8b6a12f27e81140cd84b8d9a03658d4c6d78e11f2157831a74fc74b98
- MD5 73ff2caf65b10fe0d9c862d23fc76a04
- SHA1 4fd2d5f87bb6d83534683050a15a846120deb290
- SHA512 a0e4394c484f2624d47232ad60fbab4cbad2ccb90d89d4ef947d2b3c6549f077acdc6e43b4cea1ad5c955e7f80856d359b3129ad9179fd6b61e7318bd260e1a7
- SSDEEP 393216:FJSVXJTbHbrP+pA7YNmdOVZw6AikcYuCe:7SVXxPdReouCe
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
p39e9fd4a.pd495b67a.p5a772ade.apk
Resource
android-x86-arm-20250917-en
Behavioral task
behavioral2
Sample
p39e9fd4a.pd495b67a.p5a772ade.apk
Resource
android-x64-20250917-en
Behavioral task
behavioral3
Sample
p39e9fd4a.pd495b67a.p5a772ade.apk
Resource
android-x64-arm64-20250917-en
Behavioral task
behavioral4
Sample
bnl.apk
Resource
android-x86-arm-20250917-en
Behavioral task
behavioral5
Sample
bnl.apk
Resource
android-x64-20250917-en
Behavioral task
behavioral6
Sample
bnl.apk
Resource
android-x64-arm64-20250917-en
Behavioral task
behavioral7
Sample
hibank.apk
Resource
android-x86-arm-20250917-en
Behavioral task
behavioral8
Sample
hibank.apk
Resource
android-x64-20250917-en
Behavioral task
behavioral9
Sample
hibank.apk
Resource
android-x64-arm64-20250917-en
Malware Config
Extracted
-
bingomod
-
192.119.111.208
Targets
-
- Target p39e9fd4a.pd495b67a.p5a772ade.apk
- Size 22.4MB
- SHA256 fa5c76a8b6a12f27e81140cd84b8d9a03658d4c6d78e11f2157831a74fc74b98
- MD5 73ff2caf65b10fe0d9c862d23fc76a04
- SHA1 4fd2d5f87bb6d83534683050a15a846120deb290
- SHA512 a0e4394c484f2624d47232ad60fbab4cbad2ccb90d89d4ef947d2b3c6549f077acdc6e43b4cea1ad5c955e7f80856d359b3129ad9179fd6b61e7318bd260e1a7
- SSDEEP 393216:FJSVXJTbHbrP+pA7YNmdOVZw6AikcYuCe:7SVXxPdReouCe
- MD5 SHA1 SHA512 SSDEEP
Bingomod family
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Acquires the wake lock
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
Queries the mobile country code (MCC)
Requests allowing to install additional applications from unknown sources.
Requests disabling of battery optimizations (often used to enable hiding in the background).
Requests modifying system settings.
-
- Target bnl.apk
- Size 5.2MB
- SHA256 9a1ab6d4c419466c29732782781409af941473a1f866131d0f703186b53920f8
- MD5 c2e9016ba556df95313a8e50cb40db3a
- SHA1 1153ddfcdd37848a11e00f81ca530c3df8103cea
- SHA512 8730b8f8e5f19a64a80cbbff6c6384c71c69df24fc14fbf58a963ecf06b730e2e4ee0c45c64f4e33384443817ad3e17e750296a9313f25247acfa35b8cc5769f
- SSDEEP 98304:oFrsRXoArgaNvWxtNEOkT3ugpZc7FeyjPSQUgaaQNlfnW6kwJeON8qviPwFPXlVq:o05LNOxtFkTnSbKw6lN8QjFPXPq
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target hibank.apk
- Size 5.1MB
- SHA256 8d5422d1756415d0cc6a087870f46f9e8f4290ee681a48700a702da38d7806c3
- MD5 ab16f0a62bb447076a83bcd2d897f940
- SHA1 face2eb39ebb4fb06a8360eb8909ac421ab7f28f
- SHA512 861a077c07d5be3c5e9356a2a74bee22524f4da18b1d92429168881f0225e92df86c89c21df1e588da5de3aa5f702dfc025ddaa62cff5e4dda566c7886670467
- SSDEEP 98304:a7V2/NhFNfLjkg1ttUO3z/ButMfjPoZ6Uq+xuA3KykBtuheMySaPwFPX+eX:a7OrfUSsOzB/jW66ayNhS2FPXPX
- MD5 SHA1 SHA512 SSDEEP
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1