Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.Ermac.6.origin
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) sqs.ap-nort####.amazo####.com:443
DNS requests:
- sqs.ap-nort####.amazo####.com
File system changes:
Creates the following files:
- /com.alkol.work/no_backup/androidx.work.workdb
- /com.alkol.work/no_backup/androidx.work.workdb-shm
- /com.alkol.work/no_backup/androidx.work.workdb-wal
- /data/user/####/.com_alkol_work.meta
- /data/user/####/150035
- /data/user/####/19
- /data/user/####/1XVJ06EHG1USOW65032ZPYGAJ6T3CS3.zip
- /data/user/####/2026-08-05PM042446.rt
- /data/user/####/2026-08-05PM042446.str
- /data/user/####/2026-08-05PM042457.so.rt
- /data/user/####/2026-08-05PM042503.so.rt
- /data/user/####/2026-08-05PM042559.rt
- /data/user/####/2026-08-05PM042559.str
- /data/user/####/250035
- /data/user/####/29
- /data/user/####/50PJFY9XL6JY6WOQ4PAG83R1GDV19Z3.zip
- /data/user/####/7TULIK7XAADL6RDP1PNXSPPIVJTQO8O.zip
- /data/user/####/CEJL26SARW82C89HIZKUMJGPEMHZOTU.zip
- /data/user/####/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.dex
- /data/user/####/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.vdex
- /data/user/####/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.dex
- /data/user/####/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.vdex
- /data/user/####/androidx.work.workdb
- /data/user/####/androidx.work.workdb-journal (deleted)
- /data/user/####/androidx.work.workdb-shm
- /data/user/####/androidx.work.workdb-wal
- /data/user/####/empty_classes.dex
- /data/user/####/empty_classes.zip
- /data/user/####/lastReportSendTimeFile
- /data/user/####/sealed1.obk
- /data/user/####/sealed1.ovk
- /data/user/####/sealeh.bdc
- /data/user/####/settings.xml
- /data/user/####/stat1
- /data/user/####/working
Miscellaneous:
Executes the following shell scripts:
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/50PJFY9XL6JY6WOQ4PAG83R1GDV19Z3.zip.cur.prof
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/7TULIK7XAADL6RDP1PNXSPPIVJTQO8O.zip.cur.prof
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/CEJL26SARW82C89HIZKUMJGPEMHZOTU.zip.cur.prof
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/50PJFY9XL6JY6WOQ4PAG83R1GDV19Z3.odex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/50PJFY9XL6JY6WOQ4PAG83R1GDV19Z3.vdex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/7TULIK7XAADL6RDP1PNXSPPIVJTQO8O.odex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/7TULIK7XAADL6RDP1PNXSPPIVJTQO8O.vdex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/CEJL26SARW82C89HIZKUMJGPEMHZOTU.odex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm64/CEJL26SARW82C89HIZKUMJGPEMHZOTU.vdex
- dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.dex --compiler-filter=verify-none --instruction-set=arm64
- dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.dex --compiler-filter=verify-none --instruction-set=arm64
- getprop ro.dalvik.vm.isa.arm
- getprop ro.dalvik.vm.isa.arm64
- sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EC60R3W8X4DAAYAE093Z5TIRMMJU5WG0.dex --compiler-filter=verify-none --instruction-set=arm64
- sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/ZSDV7M8S8S6F4U5O0W48ZVPVP1XY00TG.dex --compiler-filter=verify-none --instruction-set=arm64
Loads the following dynamic libraries:
- libcovault-appsec
Uses special library to hide executable bytecode.
Gets information about network.
Intercepts notifications.
Requests the system alert window permission.
Attempts to detect sandbox environment.
Contains hidden alternative main activities.
