1a5f10475e9e8f5b13f4cee4641ff7d2a2e77ec3fbef3a3b14c535156291c1ef

Analysis

max time kernel
122s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.x9bet777x96.h5app.apk
Size 3.4MB
Sample260717-pl8dsaaz9n
SHA256 1a5f10475e9e8f5b13f4cee4641ff7d2a2e77ec3fbef3a3b14c535156291c1ef
MD5 544fec971c90a67f329ab58da6a639a4
SHA1 9d5ed01b21a83e11481268ead076091cb6bb72fe
SHA512 9994ef575346f2d366792c9999c184a893f097e4aee7cc589a033f70a40237fab6453914d0c8d4bab5805a902de0c395302952ffd552be4be71afb1f671037d7
SSDEEP 98304:AU3jMmX/mGmPiA5oHZqv4hAD1TL5gQB/1Q6:XR6vUZI4hA5TL+ax
TLSH
T1AAF53302FE725DF5F2D350760AB807E1356F7E646AB12F12527DBF3424B8262AA14C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.name	com.x9bet777x96.h5app
Accessed system property	key: ro.hardware	com.x9bet777x96.h5app
Accessed system property	key: ro.bootmode	com.x9bet777x96.h5app
Accessed system property	key: ro.bootloader	com.x9bet777x96.h5app
Accessed system property	key: ro.product.model	com.x9bet777x96.h5app
Accessed system property	key: ro.product.device	com.x9bet777x96.h5app

Checks Qemu related system properties. 1 TTPs 12 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.qemu.vsync	com.x9bet777x96.h5app
Accessed system property	key: qemu.logcat	com.x9bet777x96.h5app
Accessed system property	key: init.svc.qemud	com.x9bet777x96.h5app
Accessed system property	key: qemu.hw.mainkeys	com.x9bet777x96.h5app
Accessed system property	key: ro.kernel.android.qemud	com.x9bet777x96.h5app
Accessed system property	key: ro.kernel.qemu.gles	com.x9bet777x96.h5app
Accessed system property	key: ro.kernel.qemu	com.x9bet777x96.h5app
Accessed system property	key: init.svc.qemu-props	com.x9bet777x96.h5app
Accessed system property	key: qemu.sf.fake_camera	com.x9bet777x96.h5app
Accessed system property	key: qemu.gles	com.x9bet777x96.h5app
Accessed system property	key: ro.kernel.qemu.wifi	com.x9bet777x96.h5app
Accessed system property	key: vendor.qemu.dev.bootcomplete	com.x9bet777x96.h5app

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.x9bet777x96.h5app

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.x9bet777x96.h5app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.x9bet777x96.h5app:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.x9bet777x96.h5app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.x9bet777x96.h5app

com.x9bet777x96.h5app
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4674

com.x9bet777x96.h5app:remote
1⤵
- Queries information about active data network
PID:4820

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

.jwebdid

Path /data/data/com.x9bet777x96.h5app/files/.jwebdid
Size 16B
SHA256 c6ddfb243c1291813e474257148023c986f583a93fc5af1cd6b2a9dad44e3fa0
MD5 7fafd791772d879a9a4ff7d6e6f8b6d5
SHA1 20f8352fa6b1378d3db4fba74cfff0cfd04968a2
SHA512 5aee97a7e9c991505656ccb4686852eafd04d2bc53f2a6a3f2052a6ea73bee44466866f26c14e7c111ff90d53e1677ad68a9cc25755d672653b1261d489ca639
MD5 SHA1 SHA512

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 453e51e660a485187c48aef0a759cecbb0e6ae78f61ba6838855bb836f73e7b3
MD5 3aa606731e679f0e2222cc899c7913c5
SHA1 b6c2df7081b701766c4fa9ca9586ec7408464b38
SHA512 bc9e16d0c02e7bf840a534f0a0f2340c781e582e713884013430273bb64f77c51835fe335b87b2617a93e2280c23ccf5db909807d11a2bf23de600fca0ca13bd
TLSH
T1FA216D199D016B38F84147B86137822A33708DC78B9CC1BD76E324861957A96C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 a43f5011cab28898d9091a841367cb83b2b41f5aee572c76f8dc5d1243ff7755
MD5 f69f44baa6313bba14f3090a3d40b6d0
SHA1 cfcfaa31c3a805681178f10972ff192e2d5664f3
SHA512 ae3a62c0756cb983a9c7215476de1ef437ad8e62415bf3e6fc71b7edaad2c4abc9ef61c6e2e8137f644219d525a737056eba6396defec699d83a30f392c17e8b
TLSH
T1D1216D199D016B78F94147B96133822A33708DC68B99C1BD76E328860957E96C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 897835f59e72fd2ae13ae4cef953d82524dededb8e929cf8b5008a6021ae21b8
MD5 3560084db0cc3b7dd4f7f95560c6e6c4
SHA1 93550dcd66636022a4cb5ff64ac13aa31a06c83f
SHA512 f6c81ea2e1d85a25bdfe2f445204722c58ddf7cbcf81e431b63e33d0273cc4da89ab1ee804402556052cc550f9ba31ecbc6df75f6deba60b15acc473b932d150
TLSH
T1CB21E25D9D00AE3DF481C7BC6173C26937705442C85882F876D318464367D96D8BEB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 b7f6c70e2d6f26fa97dfe30823c11ca72303b29d8e466514fcc76166efc437b2
MD5 089c8dea3927688958253cac4f21e5c3
SHA1 b8a2b6919b3efae4abb03ecbc6d680a25c94ec1e
SHA512 4f1cc7d77831aed6a258f25ff67d164a1ea05e6cf6fce5555ffe692e1c72d9a7e1b021ff43adc94dd88a2eec162b8bc8270982393e6a65bbe7a9c96b1da06265
TLSH
T159216D199D01AA38F84147B86133822A33708DC68B98C1BD76E328860557A96C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 fd37223d09eb89a20c6852b60999dc219d184fa2105092e962c3f450df7d5d01
MD5 63fd09ec8e640139cfecad5f8b3e4253
SHA1 6315ae8594953b2d88ffdd205b9cfeb88706fea7
SHA512 c1bea0b53e5a1a461d2b0b7692d3167f47863c22e687fe2d2a0d31970b69a8c01660eea23aa6f807cfd4262f3db2cd3082de932394d0a87ab84172af579dd7df
TLSH
T177216D199D056A38F84157BC6133822633708DC68B98C1BD76E32486095BA96C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoPackageQueue
Size 1KB
SHA256 af191199b8c9022e3d0e289c8728dcf9b9f1b9efface334084978e401b52d472
MD5 170d57d954de36ab5848ea715a04a4f4
SHA1 3fc533e9b5871183dd16cd93c4fcdb5f998e3b41
SHA512 4349e571b1c8cde72bcf1b15e96cc5101f089fc36583d0ece9f73a6934dc1d21f2dc9c5652a08a557579fb9f0c44bf1acb0bcc7e89bda93295b4fcaf783f66b2
TLSH
T14941A83B75406131CE63C57CAC06C33D6A7875A36638B05D6BD21DD11707ED58A36B4A
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoPackageQueue
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
TLSH
T109A00475D5417C71D351113C5415440C50505570C107D57CD7415470310D0D0477FD7C
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x96.h5app/files/AdjustIoPackageQueue
Size 1KB
SHA256 270f05f1e44d5c6a694393f16c26d5bfc5d05ff60e165904545985d59c7ddc51
MD5 9a8e8458e213b1e943499b49c2201f9c
SHA1 0dd009aa14a3d8a1032d778ffc297cd979b0ac64
SHA512 f4219f688f04f23970e3b923752f33ac9cb3f0b8c581e801fb590c024ee736f50c112ec51688c2118a061ab5c12acd33480ac904a25d021c39d7bab09364f57d
TLSH
T1A141A82F79506531DE53C53CBC46C32D16B826E26634F1585BE21CC22707FD5C625B46
MD5 SHA1 SHA512 TLSH

Submit Download

1784291177174

Path /data/data/com.x9bet777x96.h5app/files/com_engagelab_privates_core/97a2ed396ce03b59d945809c/1784291177174
Size 1KB
SHA256 8ca58e7a1c1a253690e3881743a13b7ed19e031ac961e00178407ed87f187cdd
MD5 98096ee1886f2c5a8e066ffb1cd219af
SHA1 479262b7e39a3a64778d421a675788720918e834
SHA512 1d3605ac3cf8803f6915382e6bb71108c186d5be71a681ac4974f72611b8a6f8230bbda5bb2395b4c121e436fb99c03ad35063bc1a1a0eb2791d6ffb170a1cd0
TLSH
T10D2180199D01AA38FC4147FC6133822A33708DC68B9CC1BD76E328860557E96C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads