General
- Target sberkids.apk
- Size 119.0MB
- Sample261101-1an2jsds9v
- SHA256 f63fd63d7ab33e9c05082ce0dd9a04e7714bd2192dc5dca54ad16b6765fcd934
- MD5 b5dd26d21bf3b85c66287ec82ce9e060
- SHA1 8c92a759ad193d9e5e0e2c8fc5a6353c13df3c2b
- SHA512 3c1e39b9b9cbb190e566918fce629feed25205c159d66b859bddfb2ca42d30f5d7aa62400590627686a9b0d3bb255902db28d61e6f058bfa4b352f739a2ae60a
- SSDEEP 3145728:2M+GXTAiy4+98cYGZk53zII2KBjG8lTAGAd08:2M+GXm98cpZI3zIhCq8J2d08
- TLSH T19658339BF328DC2EE93751714C6D063669111C1AAA42AB8B7858373D387B7E80F597CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
sberkids.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral2
Sample
sberkids.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
sberkids.apk
Resource
android-x86-arm-20260325-en
Malware Config
Targets
-
- Target sberkids.apk
- Size 119.0MB
- SHA256 f63fd63d7ab33e9c05082ce0dd9a04e7714bd2192dc5dca54ad16b6765fcd934
- MD5 b5dd26d21bf3b85c66287ec82ce9e060
- SHA1 8c92a759ad193d9e5e0e2c8fc5a6353c13df3c2b
- SHA512 3c1e39b9b9cbb190e566918fce629feed25205c159d66b859bddfb2ca42d30f5d7aa62400590627686a9b0d3bb255902db28d61e6f058bfa4b352f739a2ae60a
- SSDEEP 3145728:2M+GXTAiy4+98cYGZk53zII2KBjG8lTAGAd08:2M+GXm98cpZI3zIhCq8J2d08
- TLSH T19658339BF328DC2EE93751714C6D063669111C1AAA42AB8B7858373D387B7E80F597CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Checks the application is allowed to request package installs through the package installer
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Checks the presence of a debugger
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
3System Checks
3