BingoMod: recovered C2 indicators & analysis

What BingoMod is

BingoMod is an Android remote access trojan (RAT) discovered and analyzed by the Cleafy Threat Intelligence and Response (TIR) team at the end of May 2024. Because researchers could not tie it to any known family, they named it BingoMod. Its principal objective is to initiate fraudulent money transfers directly from a victim's compromised device via account takeover (ATO), using the On-Device Fraud (ODF) technique so that transactions originate from the trusted device and bypass many authentication, verification, and behavioral fraud-detection controls.

The malware is distributed through smishing (SMS phishing) campaigns and side-loading, masquerading as a legitimate mobile security or antivirus tool (and, in some samples, a Chrome update). After installation it social-engineers the user into granting Accessibility Services, which it then abuses to read on-screen content (credentials, account balances), log keystrokes, intercept SMS messages, and programmatically drive the user interface. It establishes a socket-based channel with its command-and-control (C2) infrastructure to receive roughly 40 remote commands, and uses a separate HTTP-based channel to exfiltrate screen images. Screen content is captured through the Android Media Projection API, giving operators a VNC-like real-time view, while accessibility-driven input injection lets them tap buttons, fill forms, and navigate between apps.

The money-transfer operations are not fully automated: they rely on a live human operator interacting with the device in real time, with individual transfers reported at up to approximately EUR 15,000. BingoMod also supports overlay attacks and fake notifications for phishing, transmission of fake SMS messages, and the blocking or uninstalling of applications to evade defenses. A notable feature is a device-wiping capability: after a successful fraudulent transfer, the malware typically wipes the device (documented against external storage, with a suspected but less-certain capability for a fuller reset) to remove traces and obstruct incident response, behavior researchers compared to the earlier BRATA malware.

At the time of reporting, Cleafy assessed BingoMod as being in an active development phase, with authors focused on experimenting with obfuscation to lower antivirus detection rates rather than expanding functionality. The malware supports English, Romanian, and Italian, and code comments and telemetry led researchers to attribute it, with moderate confidence, to a likely Romanian-speaking developer or group.

Capabilities

• Abuse of Android Accessibility Services for on-screen data theft and UI automation
• Keylogging of credentials and bank account balances
• SMS interception, including one-time passwords / 2FA codes
• Transmission of fake SMS messages
• Screen capture via the Android Media Projection API (VNC-like live view)
• Real-time remote device control (taps, text input, app navigation) via input injection
• On-Device Fraud (ODF) account-takeover money transfers driven by a live operator
• Overlay attacks and fake notifications for phishing
• Blocking and uninstalling applications for defense evasion
• Device wiping (documented for external storage) after a fraudulent transfer to hinder forensics
• Socket-based C2 with roughly 40 supported remote commands and an HTTP channel for screen images

Known C2 / channel types: Raw TCP socket (command channel), HTTP (screen-image / data exfiltration channel).

MITRE ATT&CK (Mobile)

Techniques commonly associated with BingoMod:

What Privara Unmask recovered

Two C2 ports on the same host were recovered from the executed sample. A separately-observed Cloudflare address (104.24.181.7) is a fronting IP and was excluded as low-confidence. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• BingoMod: The new android RAT that steals money and wipes data
  Cleafy Labs
• New Android Banking Trojan BingoMod Steals Money, Wipes Devices
  The Hacker News
• BingoMod Android RAT Wipes Devices After Stealing Money
  SecurityWeek
• BingoMod Android RAT steals money from victims' bank accounts and wipes data
  Security Affairs

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.