cifrat Android RAT impersonates Booking.com

3 April 2026 medium threat

CERT Polska documented cifrat, a multi-stage Android RAT delivered via fake Booking.com update pages, granting attackers accessibility-based remote control, SMS, camera and SOCKS5 access.

CERT Polska analyzed an Android malware sample, internally named cifrat after its package string and RAT capabilities, distributed through a phishing chain that impersonates Booking.com's Pulse partner application. Victims receive a phishing email leading through a share.google redirect to a fake booking.interaction.lat update page, which serves a malicious APK (com.pulsebookmanager.helper). This outer dropper loads a native library for anti-debugging/anti-analysis checks and string deobfuscation, then XOR-decrypts and installs a second APK (io.cifnzm.utility67pu, disguised as 'Google Play Services') via PackageInstaller. That second stage already ships accessibility, SMS, device-admin, screen-capture, and camera components, but its Application class further decrypts a hidden asset (FH.svg) using an RC4-like cipher to unpack the final malicious dex files.

The fully unpacked payload is a persistent Android RAT featuring accessibility-driven overlay injection, keylogging, screen and camera streaming, SMS collection, remote gesture injection, uninstall protection, and SOCKS5 tunneling, all controlled through a dual WebSocket architecture (separate control and data channels) connected to otptrade.world. Installation telemetry (dropper_opened, install_started, implant_launched, etc.) is reported to a separate infrastructure host, aplication.digital. Throughout the infection chain, the malware repeatedly re-displays the same spoofed Booking.com branded page to maintain the illusion of a legitimate security update, while building increasingly deep layers of obfuscation, native code gating, and persistence mechanisms typical of commercial Android RAT-as-a-service tooling.

CERT Polska could not confidently attribute the sample to a known malware family or threat actor at analysis time. The report provides technical unpacking methodology (XOR/RC4 key recovery, native JNI string decoding) enabling defenders and researchers to reproduce each unpacking stage independently.

Mentioned in this report

Malware cifrat

Detection guidance

Android App Installing Second APK via PackageInstaller

ATT&CK T1407

Dropper APK spawning PackageInstaller to dynamically load and install a second APK at runtime — typical staged malware delivery pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Android App Installing Second APK via PackageInstaller
description: Detects Android application invoking PackageInstaller to install a second
  APK, characteristic of staged dropper malware that decrypts and installs a second-stage
  payload at runtime.
tags:
- attack.execution
- attack.t1407
logsource:
  category: process_creation
  product: android
detection:
  selection:
    Image|endswith: PackageInstaller
    CommandLine|contains: install
  filter_system_updates:
    CommandLine|contains:
    - /system/
    - com.android.systemupdate
  condition: selection and not filter_system_updates
falsepositives:
- Legitimate app store or system update components installing signed system APKs
- MDM solutions performing managed app installation
level: high
id: b97b0b3a-8baf-5139-92e7-0996efb88ca0
status: experimental
author: Vorant

Native Library Loading for Anti-Analysis and Decryption

ATT&CK T1633

Android application loading a native .so library to perform anti-debugging/anti-analysis checks and string deobfuscation — sandbox evasion via native code gating. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Native Library Loading for Anti-Analysis and Decryption
description: Detects Android app loading native libraries (.so files) for anti-debugging,
  anti-analysis, or runtime string deobfuscation. Native libraries are often used
  by malware to gate access to sensitive operations from sandboxes and reverse-engineering
  tools.
tags:
- attack.defense-evasion
- attack.t1633
logsource:
  category: process_creation
  product: android
detection:
  selection:
    Image|endswith: app_process
    CommandLine|contains|all:
    - System.load
    - .so
  selection_jni_string_decode:
    CommandLine|contains:
    - env->GetStringUTFChars
    - native decod
  filter_legitimate_libraries:
    CommandLine|contains:
    - libc.so
    - libm.so
    - com.google.android.gms
  condition: (selection or selection_jni_string_decode) and not filter_legitimate_libraries
falsepositives:
- Apps using legitimate encryption libraries (e.g., OpenSSL via NDK)
- Gaming engines loading native physics/graphics libraries
level: medium
id: 292cf99c-d7d0-58cf-814e-e599627bab67
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/cifrat-analysis

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free