Overview
In May 2024, researchers from Cleafy TIR released information about a new Android Remote Access Trojan (RAT), named BingoMod. This malware is unique, as it does not appear to be linked to any previously recognized malware families.
Key objectives of BingoMod include facilitating money transfers directly from affected devices through Account Takeover (ATO). It skillfully employs On Device Fraud (ODF) techniques to outsmart security measures aimed at authenticating user identities and detecting unusual transactions.
Once installed, BingoMod uses various permissions, particularly Accessibility Services, to collect sensitive data. This includes login credentials, SMS messages, and bank account details. The malware is designed to perform overlay attacks and utilizes VNC-like capabilities for remote access, allowing attackers to deeply infiltrate the victim's device.
A notable feature is the malware's ability to wipe infected devices after committing fraudulent transactions. This action helps eliminate traces of its presence, complicating efforts for forensic analysis. BingoMod seems to target users in English, Romanian, and Italian-speaking regions.
Currently, BingoMod is still in developmental stages. Developers are working on advanced obfuscation techniques that are intended to evade detection by antivirus software. Evidence suggests that these developers may speak Romanian, guided by comments found in the malware's code.
Executive Insights
By late May 2024, a new Android RAT was detected within Cleafy telemetry systems. To provide a tracking name for this malware within their threat intelligence framework, it was labeled BingoMod. This name stems from early identifiers associated with its core functionality.
BingoMod represents a new generation of mobile malware that leverages remote access. This design allows Threat Actors (TAs) to undertake Account Takeover (ATO) actions directly from compromised devices, employing the On Device Fraud (ODF) approach. This method has been recently adapted by other banking trojans like Medusa, Copybara, and Teabot, benefiting from their practical complexities.
The techniques used present various advantages, such as requiring lower skill levels for developers and broadening the potential range of targeted banks. Importantly, these techniques can bypass numerous behavioral detection strategies that banks employ. However, a notable connection is that this approach requires ongoing human supervision for the money transfer process, limiting its scalability.
In a manner similar to Brata malware, BingoMod implements device wiping after unauthorized transfers. This self-destruction feature seeks to obliterate any evidence of its activities, complicating potential forensic investigations. The rarity of these methods in Android malware indicates that developers are aware of Brata strategies and may be adopting similar techniques.
Given its current early developmental phase, predicting the malware's future evolution remains challenging. The developer's focus on obfuscation suggests an aim toward utilizing more opportunistic strategies rather than specializing them, as seen in other malware like SharkBot or Gustuff.
| Date of Discovery | Status | Primary Targets | Affected OS | Language Focus | Distribution Type |
|---|---|---|---|---|---|
| May 2024 | Active (July 2024) | Retail Banking | Android Devices | English, Romanian, Italian | Social Engineering (smishing) |
Technical Breakdown
BingoMod malware is often distributed via smishing tactics, presenting itself as a legitimate antivirus application. Upon installation on a device, it encourages users to activate Accessibility Services, misleading them into thinking these permissions are essential for app functionality. Once permission is granted, the malicious APK begins to unpack, executing various harmful features.
Once operational, BingoMod aims to harvest sensitive data. It employs two crucial methods typical of banking trojans:
Keylogging: This technique utilizes Accessibility Services to capture sensitive information displayed on users' screens or inputted by them, which may include login details and balance inquiries.
SMS Interception: The malware monitors user SMS messages, often capturing transaction authentication numbers (TANs) used by financial institutions for security.
BingoMod's primary goal is executing money transfers via On Device Fraud (ODF). Consequently, the malware implements several remote control functions to ensure efficient operations. It establishes a socket-based connection with its command-and-control (C2) infrastructure, enabling TAs to execute commands on the compromised device.
The malware boasts up to 40 remote control features. Notably, functions related to real-time screen monitoring are facilitated as follows:
VNC-like Routine: Using Android’s Media Projection API, TAs can capture screenshots from the victim’s device consistently, providing a live view of on-screen activities.
Screen Manipulation: By leveraging Accessibility Services, BingoMod enables multiple actions for remote interaction, allowing TAs to navigate apps, click buttons, and fill out forms as if directly controlling the device.
BingoMod establishes two communication channels: a socket-based method for command control and an HTTP-based channel for transmitting captured images.
To illustrate its operational framework, a simulated C2 infrastructure can be set up. This model includes a socket-enabled C2 server for directing commands and an HTTP-based “VNC” server for managing real-time imagery from infected devices.
On the malware’s operational side, the VNC routine abuses the Media Projection API to capture and transmit live screen content. The received data is reformatted and then sent through HTTP to the TA’s setup. An intriguing aspect of this routine is its use of Accessibility Services to impersonate the user and initiate screen sharing, allowing for seamless interaction.
Once activated, TAs gain a range of commands, including:
- Launch Specific Applications: Initiating predefined applications (<LAUNCH>).
- Screen Navigation: Moving to specific areas of the display (<MOVEAT>).
- Click Actions: Clicking designated areas on the screen (<CLICKAT>).
- Text Input: Writing in text fields (<SETTEXT>).
BingoMod’s advanced features reflect its capability to exploit many weaknesses within Android environments, making it a significant concern for cybersecurity professionals and Android users alike.
Frequently Asked Questions
What are the main capabilities of recent Android RATs like Bingomod?
Recent Android Remote Access Trojans (RATs) such as Bingomod are designed to perform several malicious activities. Their primary functions include stealing banking credentials, making unauthorized transactions, and accessing sensitive personal information. These malware programs can also execute overlay attacks to deceive users into entering their information. Additionally, they may erase data from the infected device to cover their tracks after executing their malicious tasks.
How can individuals safeguard their devices against Android malware that aims to steal money and wipe data?
To protect against Android malware, users should follow these precautions:
Install Security Software: Use reputable antivirus applications to detect and block malware.
Update Regularly: Keep the operating system and all applications updated to patch security vulnerabilities.
Be Cautious with App Permissions: Review and limit the permissions granted to applications.
Download from Trusted Sources: Only download apps from the Google Play Store or verified developers.
Enable Two-Factor Authentication: Use two-factor authentication for financial accounts to add an extra layer of security.
What actions should be taken if someone suspects their Android device is infected with a RAT or similar malware?
If an individual suspects a RAT infection, they should take immediate steps:
Disconnect from the Internet: This helps prevent further data theft.
Run a Security Scan: Use an antivirus app to scan and identify any malicious software.
Remove Suspicious Apps: Uninstall any apps that seem unfamiliar or unnecessary.
Change Passwords: Update passwords for financial and sensitive accounts from a different device.
Perform a Factory Reset: If the malware cannot be removed, a factory reset may be necessary to restore the device to its original settings.
What are common ways that Android RATs like Bingomod are distributed?
Android RATs are often distributed through various methods, including:
Malicious Apps: They can be hidden within seemingly harmless applications.
Phishing Links: Users may be tricked into clicking on links in emails or messages that lead to malware downloads.
Infected Websites: Visiting compromised or malicious websites can trigger automatic downloads of RATs.
Third-party App Stores: Downloading apps from unofficial sources increases the risk of malware infection.
How does an Android RAT obtain access to a user's financial and sensitive information?
An Android RAT gains access to sensitive information by employing several techniques:
Credential Harvesting: It can capture usernames and passwords through phishing screens or by logging keystrokes.
Overlay Attacks: By creating fake interfaces, it tricks users into entering their financial details.
Remote Access: The RAT may allow attackers to control the device, making it easier to extract personal data directly.
Are there any tools or resources for identifying and removing Android RATs from infected devices?
Yes, there are multiple tools and resources available to help detect and eliminate Android RATs:
Antivirus Applications: Programs like Malwarebytes and Avast can scan for and remove malware.
Google Play Protect: This built-in tool helps in identifying harmful apps from the Play Store.
System Monitoring Tools: Applications can monitor device behavior and alert users to suspicious activity.
Online Resources: Users can find guides and forums dedicated to malware removal and cyber safety.
Focus: Parental Control and Monitoring Software. Kevin Bong contributes to Impulsec’s reviews of parental control and monitoring software. His work focuses on researching product features, usage limitations, safety considerations, and real-world suitability for families. At Impulsec, Kevin’s contributions help ensure that reviews consider ethical use, transparency, and practical expectations rather than promotional claims.