sberkids[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sberkids.apk
Size 119.0MB
Sample261101-1an2jsds9v
SHA256 f63fd63d7ab33e9c05082ce0dd9a04e7714bd2192dc5dca54ad16b6765fcd934
MD5 b5dd26d21bf3b85c66287ec82ce9e060
SHA1 8c92a759ad193d9e5e0e2c8fc5a6353c13df3c2b
SHA512 3c1e39b9b9cbb190e566918fce629feed25205c159d66b859bddfb2ca42d30f5d7aa62400590627686a9b0d3bb255902db28d61e6f058bfa4b352f739a2ae60a
SSDEEP 3145728:2M+GXTAiy4+98cYGZk53zII2KBjG8lTAGAd08:2M+GXm98cpZI3zIhCq8J2d08
TLSH
T19658339BF328DC2EE93751714C6D063669111C1AAA42AB8B7858373D387B7E80F597CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
sberkids.apk

File Explorer

sberkids.apk

.apk 119.0MB

sberkids.apk

SHA256 f63fd63d7ab33e9c05082ce0dd9a04e7714bd2192dc5dca54ad16b6765fcd934
MD5 b5dd26d21bf3b85c66287ec82ce9e060
SHA1 8c92a759ad193d9e5e0e2c8fc5a6353c13df3c2b
SHA512 3c1e39b9b9cbb190e566918fce629feed25205c159d66b859bddfb2ca42d30f5d7aa62400590627686a9b0d3bb255902db28d61e6f058bfa4b352f739a2ae60a
SSDEEP 3145728:2M+GXTAiy4+98cYGZk53zII2KBjG8lTAGAd08:2M+GXm98cpZI3zIhCq8J2d08
TLSH
T19658339BF328DC2EE93751714C6D063669111C1AAA42AB8B7858373D387B7E80F597CC
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5a0fb83d6853b85a66301a1607976f4d4733889cdaf3a81f5584d2c65404eda7

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Sberbank,OU=UVISAS,O=Sberbank of Russia,L=Moscow,ST=MO,C=RU

ru.sberbank.sberkids

android.permission.AUTHENTICATE_ACCOUNTS android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.CAMERA android.permission.FOREGROUND_SERVICE android.permission.GET_ACCOUNTS android.permission.INTERNET android.permission.MANAGE_ACCOUNTS android.permission.READ_PROFILE android.permission.RECORD_AUDIO android.permission.USE_BIOMETRIC android.permission.USE_CREDENTIALS android.permission.VIBRATE android.permission.WRITE_SYNC_SETTINGS android.permission.DETECT_SCREEN_CAPTURE android.permission.WAKE_LOCK android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK android.permission.NFC android.permission.ACCESS_WIFI_STATE android.permission.BLUETOOTH android.permission.USE_FINGERPRINT android.permission.ACCESS_COARSE_UPDATES android.permission.READ_PHONE_NUMBERS android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.ACCESS_FINE_LOCATION android.permission.MANAGE_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.KILL_BACKGROUND_PROCESSES android.permission.GET_TASKS android.permission.RECEIVE_BOOT_COMPLETED android.permission.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.permission.FOREGROUND_SERVICE_SPECIAL_USE android.permission.FOREGROUND_SERVICE_DATA_SYNC android.permission.QUERY_ALL_PACKAGES android.permission.READ_EXTERNAL_STORAGE android.permission.POST_NOTIFICATIONS android.permission.REQUEST_INSTALL_PACKAGES android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION com.google.android.gms.permission.AD_ID com.google.android.c2dm.permission.RECEIVE ru.sberbank.sberkids.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION ru.sberbank.sberkids.permission.PROCESS_PUSH_MSG ru.sberbank.sberkids.permission.PUSH_PROVIDER com.google.android.providers.gsf.permission.READ_GSERVICES android.permission.REQUEST_DELETE_PACKAGES

ru.sberbank.sberkids.service.GenericAccountService

android.accounts.AccountAuthenticator

ru.sberbank.sberkids.lib.feature.contentplayer.impl.presentation.ContentPlayerService

androidx.camera.core.impl.MetadataHolderService

androidx.work.impl.foreground.SystemForegroundService

ru.sberbank.mobile.core.push.impl.data.huawei.PushHmsMessageService

com.huawei.push.action.MESSAGING_EVENT

ru.sberbank.mobile.core.push.impl.data.firebase.PushFcmIntentService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.sessions.SessionLifecycleService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

ru.rustore.sdk.metrics.internal.presentation.SendMetricsEventJobService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.huawei.hms.support.api.push.service.HmsMsgService

com.huawei.push.msg.NOTIFY_MSG com.huawei.push.msg.PASSBY_MSG

com.huawei.agconnect.core.ServiceDiscovery

zone.bi.mobile.fingerprint.impl.cs.FpWorkerService

com.kavsdk.SdkService

com.kavsdk.JobSchedulerService

ru.sberbank.sberkids.lib.core.navigation.ShareBroadcastReceiver

ru.sberbank.sberkids.lib.core.notifications.NotificationCancellationBroadcastReceiver

ru.sber.platform.selfupdate.apk.install.receiver.UpdateCompleteReceiver

android.intent.action.MY_PACKAGE_REPLACED

ru.sber.platform.selfupdate.apk.install.receiver.UserConfirmationReceiver

ru.sber.selfupdate.USER_CONFIRMATION

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.huawei.hms.support.api.push.PushMsgReceiver

com.huawei.intent.action.PUSH_DELAY_NOTIFY com.huawei.intent.action.PUSH

com.huawei.hms.support.api.push.PushReceiver

com.huawei.android.push.intent.REGISTRATION com.huawei.android.push.intent.RECEIVE

com.kavsdk.StartReceiver

com.avsdk.READY com.avsdk.LAUNCH android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON

com.kavsdk.AppInstallationReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED

com.kavsdk.AlarmReceiver

Android Permissions

sberkids.apk

Permissions

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.FOREGROUND_SERVICE

android.permission.GET_ACCOUNTS

android.permission.INTERNET

android.permission.MANAGE_ACCOUNTS

android.permission.READ_PROFILE

android.permission.RECORD_AUDIO

android.permission.USE_BIOMETRIC

android.permission.USE_CREDENTIALS

android.permission.VIBRATE

android.permission.WRITE_SYNC_SETTINGS

android.permission.DETECT_SCREEN_CAPTURE

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.NFC

android.permission.ACCESS_WIFI_STATE

android.permission.BLUETOOTH

android.permission.USE_FINGERPRINT

android.permission.ACCESS_COARSE_UPDATES

android.permission.READ_PHONE_NUMBERS

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.ACCESS_FINE_LOCATION

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.GET_TASKS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.QUICKBOOT_POWERON

com.htc.intent.action.QUICKBOOT_POWERON

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_EXTERNAL_STORAGE

android.permission.POST_NOTIFICATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION

com.google.android.gms.permission.AD_ID

com.google.android.c2dm.permission.RECEIVE

ru.sberbank.sberkids.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

ru.sberbank.sberkids.permission.PROCESS_PUSH_MSG

ru.sberbank.sberkids.permission.PUSH_PROVIDER

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.REQUEST_DELETE_PACKAGES

Sharing

General

Malware Config

Signatures

File Explorer

sberkids.apk

File Signature issue

ru.sberbank.sberkids.MainActivity

ru.sberbank.sberkids.lib.common.assistant.default_assistant.DefaultAssistantActivity

com.google.android.gms.common.api.GoogleApiActivity

ru.rustore.sdk.activitylauncher.RuStoreActivityLauncher

com.huawei.hms.support.api.push.TransActivity

com.kavsdk.shared.cellmon.FakeActivity

com.huawei.hms.activity.BridgeActivity

com.huawei.hms.activity.EnableServiceActivity

com.google.android.play.core.common.PlayCoreDialogWrapperActivity

ru.sberbank.sberkids.service.GenericAccountService

ru.sberbank.sberkids.lib.feature.contentplayer.impl.presentation.ContentPlayerService

androidx.camera.core.impl.MetadataHolderService

androidx.work.impl.foreground.SystemForegroundService

ru.sberbank.mobile.core.push.impl.data.huawei.PushHmsMessageService

ru.sberbank.mobile.core.push.impl.data.firebase.PushFcmIntentService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.sessions.SessionLifecycleService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

ru.rustore.sdk.metrics.internal.presentation.SendMetricsEventJobService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.huawei.hms.support.api.push.service.HmsMsgService

com.huawei.agconnect.core.ServiceDiscovery

zone.bi.mobile.fingerprint.impl.cs.FpWorkerService

com.kavsdk.SdkService

com.kavsdk.JobSchedulerService

ru.sberbank.sberkids.lib.core.navigation.ShareBroadcastReceiver

ru.sberbank.sberkids.lib.core.notifications.NotificationCancellationBroadcastReceiver

ru.sber.platform.selfupdate.apk.install.receiver.UpdateCompleteReceiver

ru.sber.platform.selfupdate.apk.install.receiver.UserConfirmationReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.huawei.hms.support.api.push.PushMsgReceiver

com.huawei.hms.support.api.push.PushReceiver

com.kavsdk.StartReceiver

com.kavsdk.AppInstallationReceiver

com.kavsdk.AlarmReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

ru.sberbank.sberkids.lib.feature.updaterequired.impl.data.SelfUpdateFileProvider

com.google.firebase.provider.FirebaseInitProvider

com.squareup.picasso.PicassoProvider

com.huawei.hms.support.api.push.PushProvider

com.huawei.hms.aaid.InitProvider

com.huawei.agconnect.core.provider.AGConnectInitializeProvider

Android Permissions

sberkids.apk