Analysis
- geolocation tags
- max time kernel
56s - max time network
63s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
- submitted
01/11/2026, 21:26
General
- Target sberkids.apk
- Size 119.0MB
- Sample261101-1an2jsds9v
- SHA256 f63fd63d7ab33e9c05082ce0dd9a04e7714bd2192dc5dca54ad16b6765fcd934
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Acquires the wake lock 1 IoCs
- Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
ru.sberbank.sberkids1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
- Queries information about active data network
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
apps.dat
np.cr
np.cr
rp.cr
unspkg.cr
apum-1901g.xml
cdbm-1901g.xml
kdscrl-1901g.xml
ksnm-1901g.xml
mcertdb.dat
smm.dat
upd-1901g.xml
bif.dat.tmp
rollback.dat
cloud_ml_cache.db
config
Description.xml
EAD90538-BC9F-49B5-A322-854AFFB19B00
kc_kfp_sdk15_android.xms
kdscrl.rdb
kh_kfp_sdk15_android.xms
ksn_kfp_sdk_android.xms
ksncliwin32keys.dat
persistent_q.db
persistent_q.db-journal
persistent_q.db-wal
statcfg.xml
uaspubkeys.dat
um1901g.xml
updcfg.xml
updcfg2.xml
ksn_cache.kvdb
ksn_cache.kvdb-journal
ksn_cache.kvdb-journal
ksn_cache.kvdb-wal
ksnlocalcache.db
ksnlocalcache.db-crypto
ksnobjectscache.db
ksnlocalcache.db
ksnlocalcache.db-crypto
accessibilitySettings.json
certificate.crt
customization_config.xml
customization_config_signature
httpsca.jks
recovery.dat
recovery.dat
recovery.dat
recovery.dat
sdk.dat.tmp
sdk.dat.tmp
sdk.dat.tmp
sdk.dat.tmp
sdk.dat.tmp
sdk.dat.tmp
um1901g.xml
cdbm-1901g.xml
mcertdb.dat
kmsh2-all-1901g.xml
android.kdc
kavheur.kdl
kavheur.vds
kmsh2-x64-1901g.xml
mh001.kdc
mh002.kdc
mh003.kdc
mh004.kdc
mh005.kdc
mh006.kdc
mh007.kdc
mh008.kdc
mh009.kdc
mh010.kdc
mh011.kdc
mh012.kdc
mh013.kdc
mh014.kdc
mh015.kdc
mh016.kdc
mh017.kdc
mh018.kdc
mh019.kdc
mh020.kdc
mh021.kdc
mh022.kdc
mh023.kdc
mh024.kdc
mh025.kdc
mh026.kdc
mh027.kdc
mh028.kdc
mh029.kdc
mh030.kdc
mh031.kdc
mh032.kdc
mh033.kdc
mh034.kdc
mh035.kdc
mh036.kdc
mh037.kdc
mh038.kdc
mh039.kdc
mh040.kdc
mh041.kdc
mh042.kdc
mh043.kdc
mh044.kdc
mh045.kdc
mh046.kdc
mh047.kdc
mh048.kdc
mh049.kdc
mh050.kdc
mh051.kdc
mh052.kdc
mh053.kdc
mh054.kdc
mh055.kdc
mh056.kdc
mh060.kdc
mh062.kdc
mh063.kdc
mh064.kdc
mh065.kdc
mh066.kdc
mh067.kdc
mh068.kdc
mh069.kdc
mh070.kdc
mh071.kdc
mh072.kdc
mh073.kdc
mh074.kdc
mh075.kdc
mmh001.kdc
mmh002.kdc
mmh003.kdc
mmh004.kdc
mmh005.kdc
mmh006.kdc
mmh007.kdc
mmh008.kdc
mmh009.kdc
mmh010.kdc
mmh011.kdc
mmh012.kdc
mmh013.kdc
mmh014.kdc
mmh015.kdc
mmh016.kdc
mmh017.kdc
mmh018.kdc
mmh019.kdc
mmh020.kdc
mmh021.kdc
mmh022.kdc
mmh023.kdc
mmh024.kdc
mmh025.kdc
mmh026.kdc
mmhlnk01.kdc
mmhlnk02.kdc
mmhlnk03.kdc
paths.xms
smh001.kdc
smh2_x64.stt
smheur2.mft
verdicts.ini
uaspubkeys.dat
upd-1901g.xml
updcfg.xml
updcfg2.xml
ticket.dat.tmp
ticket_hdr.dat
tmpIO.32773804128263725957776-0
tmpIO.32773804128263725988928-0
tmpIO.32773804128263726247296-0
tmpIO.32773804128263726247296-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726250464-0
tmpIO.32773804128263726280560-0
tmpIO.32773804128263726280560-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725954608-0
tmpIO.32773805128263725987872-0
tmpIO.32773805128263725987872-0
tmpIO.32773805128263725998256-0
tmpIO.32773805128263725998256-0
tmpIO.32773805128263726009696-0
tmpIO.32773806128263725961472-0
tmpIO.32773806128263726088016-0
tmpIO.32773806128263726122160-0
tmpIO.32773806128263726280560-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725903744-0
tmpIO.32773807128263725927680-0
tmpIO.32773807128263725952672-0
tmpIO.32773807128263725952672-0
tmpIO.32773807128263725952672-0
tmpIO.32773807128263725957776-0
tmpIO.32773807128263725966400-0
tmpIO.32773807128263726226176-0
tmpIO.32773807128263726233744-0
ksnlocalcache.db
ksnlocalcache.db-crypto
quarantines_index.db
AndroidManifest.xml
base.3277.tmp
clkstr_database.db
clkstr_database.db-journal
clkstr_database.db-shm
clkstr_database.db-wal
clkstr_database.db-wal
clkstr_database.db-wal
clkstr_database.db-wal
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.crashlytics.settings.json
internal-keys
report
user-data
PersistedInstallation2258669117253194226tmp
PersistedInstallation9176224076461554355tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo4OTIzNjM4NTI3NjY6YW5kcm9pZDpiN2MxMWFlMjA1MzY4N2Jl.preferences_pb.tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo4OTIzNjM4NTI3NjY6YW5kcm9pZDpiN2MxMWFlMjA1MzY4N2Jl.preferences_pb.tmp
sessionConfigsDataStore.data.tmp
sessionDataStore.data.tmp
ru.sberbank.sberkids.starting_backgrounds.preferences_pb.tmp
ksn_uuid.dat
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof.kOcfrm.tmp
m
t
d
p
s