bingomod | 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa

Sharing

Copy URL Twitter E-mail

General

Target
2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa.apk
Size 22.3MB
Sample260813-bnhn9axthy
SHA256 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa
MD5 ce361748bed2a8cb5e023eccb1736a17
SHA1 1f5e242d3ad27016099ec343a434c4166d0a951d
SHA512 c90338358399768fec43fd617c0d81142b1913f08fa86e51843a7f003e5e287d4052ecbda7a902fe50a099f0a9db5404f4732a23bc7b26ea98240f46b3238231
SSDEEP 393216:AQpO/DjWfPOaOMbU4NtdOVZw6AikcYuCP:A5DFhbyeouCP
TLSH
T1AA376C09E403FD69D79968764D66C41967B1BC86FE8B1363F30EB7BF38A215D8608384
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa.apk
- Size 22.3MB
- SHA256 2b332adf4e52168cbd2e76866165a5c6f421d15b5778d44f78f0d86c4c26b9fa
- MD5 ce361748bed2a8cb5e023eccb1736a17
- SHA1 1f5e242d3ad27016099ec343a434c4166d0a951d
- SHA512 c90338358399768fec43fd617c0d81142b1913f08fa86e51843a7f003e5e287d4052ecbda7a902fe50a099f0a9db5404f4732a23bc7b26ea98240f46b3238231
- SSDEEP 393216:AQpO/DjWfPOaOMbU4NtdOVZw6AikcYuCP:A5DFhbyeouCP
- TLSH
  T1AA376C09E403FD69D79968764D66C41967B1BC86FE8B1363F30EB7BF38A215D8608384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery bingomod infostealer persistence rat trojan evasion impact
- Family: BingoMod
  BingoMod is an Android RAT first seen in May 2024.
  trojan infostealer rat bingomod
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests modifying system settings.
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  bnl.apk
- Size 5.2MB
- SHA256 90b8cf2581f3c10280f6351a101855b15e19ac3045e6a758a03d57719298d105
- MD5 9d0294a16cde2febdbd7aef859c7fc8b
- SHA1 82e28e00a80187baf020ef3afbbaca6f19555e82
- SHA512 233a1b43657b14a00f9ae71e6e244e16ad7d4bee81ce00c2f06a824fe130079d2ed300afd911fea5cbfc115a6b6242e6e1901d23db4a282320aebdb1aad439e7
- SSDEEP 98304:5tvemxMTKAXhaIc6Lx2LIvREdA+aONYXa6llRhwAHB6L33PyVvxYC+ATPwFPXwVV:PvemyvgLM6dwONYXa4RDHBYUvxYTTFPe
- TLSH
  T1274622527B99AF1EC87360720D492635604AEC27CB57C353DD790B5AB48BAF40F063EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6
- Target
  hibank.apk
- Size 5.1MB
- SHA256 8d5422d1756415d0cc6a087870f46f9e8f4290ee681a48700a702da38d7806c3
- MD5 ab16f0a62bb447076a83bcd2d897f940
- SHA1 face2eb39ebb4fb06a8360eb8909ac421ab7f28f
- SHA512 861a077c07d5be3c5e9356a2a74bee22524f4da18b1d92429168881f0225e92df86c89c21df1e588da5de3aa5f702dfc025ddaa62cff5e4dda566c7886670467
- SSDEEP 98304:a7V2/NhFNfLjkg1ttUO3z/ButMfjPoZ6Uq+xuA3KykBtuheMySaPwFPX+eX:a7OrfUSsOzB/jW66ayNhS2FPXPX
- TLSH
  T13B46235277A99F1ECCB310760D592632604AEC27CB56C383EC791B99689BBF00F453E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8 behavioral9