77661bb377b4f0e666c61ebea721601e8933f199d6872976087c28cba1046249

Analysis

max time kernel
122s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.x9bet777x117.h5app.apk
Size 3.4MB
Sample260717-pl8dsaaz9p
SHA256 77661bb377b4f0e666c61ebea721601e8933f199d6872976087c28cba1046249
MD5 ae3c73246efddd7ed0490729452fc424
SHA1 207f6efb0c0c0a78d9abf09a76f7222162e61038
SHA512 473705938cfc2a697ccb6228ba134edc2d177d19119ffb39f47c5e3b6f2619b50b1ce6989211fc367774a48777e64fde765c8d754af90455ce7d59db9ce8be86
SSDEEP 98304:TU3jvmX/mXmPiAGoHZqvbhADDFr5gQB/1Q8:WAjvpZIbhAXFr+aL
TLSH
T154F53302FA729DB5F2D350360AA507D1316E7E646AB12F12527EBF3434FC662EA14C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.x9bet777x117.h5app
Accessed system property	key: ro.product.device	com.x9bet777x117.h5app
Accessed system property	key: ro.product.name	com.x9bet777x117.h5app
Accessed system property	key: ro.hardware	com.x9bet777x117.h5app
Accessed system property	key: ro.bootmode	com.x9bet777x117.h5app
Accessed system property	key: ro.bootloader	com.x9bet777x117.h5app

Checks Qemu related system properties. 1 TTPs 12 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.android.qemud	com.x9bet777x117.h5app
Accessed system property	key: ro.kernel.qemu.gles	com.x9bet777x117.h5app
Accessed system property	key: ro.kernel.qemu	com.x9bet777x117.h5app
Accessed system property	key: ro.kernel.qemu.wifi	com.x9bet777x117.h5app
Accessed system property	key: vendor.qemu.dev.bootcomplete	com.x9bet777x117.h5app
Accessed system property	key: ro.kernel.qemu.vsync	com.x9bet777x117.h5app
Accessed system property	key: qemu.sf.fake_camera	com.x9bet777x117.h5app
Accessed system property	key: qemu.logcat	com.x9bet777x117.h5app
Accessed system property	key: init.svc.qemud	com.x9bet777x117.h5app
Accessed system property	key: qemu.hw.mainkeys	com.x9bet777x117.h5app
Accessed system property	key: qemu.gles	com.x9bet777x117.h5app
Accessed system property	key: init.svc.qemu-props	com.x9bet777x117.h5app

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.x9bet777x117.h5app

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.x9bet777x117.h5app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.x9bet777x117.h5app:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.x9bet777x117.h5app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.x9bet777x117.h5app

com.x9bet777x117.h5app
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4765

com.x9bet777x117.h5app:remote
1⤵
- Queries information about active data network
PID:4812

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

.jwebdid

Path /data/data/com.x9bet777x117.h5app/files/.jwebdid
Size 16B
SHA256 85d5a4359ab32d89c3a3ccef102d482a5c2b136fe3a43ef6329b2df43e1c8d37
MD5 046ddda8855bbcd548025a48734b9d9c
SHA1 37d2f42ef36647db5433fce309b1acfa2d06c5a6
SHA512 40b86a3efc0d5b77a573888f65d3068e39611833e056bfe8a3f04aa5f4b434180d404ff8654ac4a68a9b2e5d1324b339853d0766249a7b34aa80ce130c48485c
MD5 SHA1 SHA512

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 046c255e2a530ce805c3bbce38645b47f912ee650f7ba0f80495a6480bd99021
MD5 3905425e81c8afbb78b97e9375540ee3
SHA1 dec3422fd4bb51115c60a0eeefdd596a40fef8d3
SHA512 21a70aef0733b02d10e6070642926bb5ebf3d8e20ddea0cce47af4150fd075b4716b39bfa87d7c25c5eadbb80821c3017da17bacf1dedc846d3b49ff40d5b642
TLSH
T1C621C0259D01AB78F84147BC6033822A337089C68B98C1BD76F32487065BA91C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 fb16e1b0e8570f47e426958615df30cb7048d58c1fca88304eef27cba2687d27
MD5 8601da4b18274ab46411d1299403c6ba
SHA1 ed01ba0751ec5a3c7caa6313e404f445d42b6eab
SHA512 f5bfd13b2c7d85790bee47e311db6a2c7cc9f6836b7e72d65ec4cc4369591930c7ef4bc968140e8b005ef7d4141ebbb1523a8d0ecaa6cb2ae5927c2603035ba1
TLSH
T18A21C3159D01AA78FD4147FC60338326337089C68B98C1BD76F324870557A95C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 4963455d0ab2eea1efe2f163e0a6256a2628c6765da0db22667b27e37a35ac47
MD5 4621a9cb8c55c4bb40abd4a2eb37eee1
SHA1 5e76d2c78583bdbdd2ac1418101ea73afca27828
SHA512 5678f38cc29654cc3b03af6c9fcb61310f6a51fac04da80766ab537f435cb8c8fd18b682f0453567c5b5064a5a555e68163200e371bf6f3050b5ec4234a878de
TLSH
T15321CC18AD40AE7DF8818BBD6077C26623709542C468C2B866E318534356D92D8BEB23
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 214599491cce68ea518ce1466e5251eb3511bcc471da5d8d22d40036a9d38370
MD5 c7e6af286be936ac88728166783c6af5
SHA1 14664c3c07aa86ed4441ed9cf0ea3d79b5a8114c
SHA512 dbafdee0475f59e1233e56629f98d0153fd031bc0b778c139465b924f11aeb1869ff5f69cb3e7afc411c9e6d7e89a94d38def9c25e76d39abd00de0ae3a59936
TLSH
T1DE2180159D01AB78F94157BC61338226337089C68B98C1BD76F32487065BB95D8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoActivityState
Size 1KB
SHA256 8dd2595028923cdc7fe2756d9f8d9c5591bfc3a3b24ba5c3bc1bda4ac61f02f1
MD5 8f9e7faa485228e8303805d463409cd3
SHA1 a5630c507a22e451db4005882959e98eddc71ae3
SHA512 9d77f88f170005f2a5b0b6b7ef69b30afefc05809e0f406914c08cb01e387acffa14bb63306aaebd96bdff5903fdb7ea3a1c4a4dd992bcb08e236c05ab532f79
TLSH
T1F321C0199D01AA78F84147FC60338226337089C68F98C1BD76F32887165BA91C4FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoPackageQueue
Size 1KB
SHA256 dc5e8774bae007a350669be0be11d54e6bf877dc4cff6d24abcd814e85f4938f
MD5 5318aa79686ba547d7b2b7ab8dd201d8
SHA1 f3d7e47bdc1792cdc75bf6f7fe2a8d28336d226c
SHA512 65c12840a64cf2c4a4d8c293209979b1270bb6f74cc1af3951f2b20a987512778fcdbeb98e1bd99ba75bb9f77b19cdc9a1d5573fce6e002917f15d7cfd0916f6
TLSH
T11E41A63B75806532CE63857CAC45C73D2AA471E2A678E49C6BA30CC22707EC5862674B
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoPackageQueue
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
TLSH
T109A00475D5417C71D351113C5415440C50505570C107D57CD7415470310D0D0477FD7C
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.x9bet777x117.h5app/files/AdjustIoPackageQueue
Size 1KB
SHA256 659c98434d3a78a270dde13e21a74224f732559a7ccb152095e8027c3fc68456
MD5 a0895e5a2c98818d25d332d5252e0779
SHA1 888e148605e952b34feb14418022bfd10ce124f9
SHA512 1a7293eb4d47dc232b8f2ac5cd476b5718358e6572aeb85488de1c8fe57d5966b3354e427bd242510ed7b667875d9dc7194d7d9cf029c31eabfddd8c4355565c
TLSH
T16741A62B76806631DFA3C63D7C56C32D16B866E26634F1585BE21CC32707FD4C626B46
MD5 SHA1 SHA512 TLSH

Submit Download

1784291177492

Path /data/data/com.x9bet777x117.h5app/files/com_engagelab_privates_core/97a2ed396ce03b59d945809c/1784291177492
Size 1KB
SHA256 09e0e339cf1dfedd57ce5948c2bfd5c4be5103f8843b96cbfed818600c19f9d7
MD5 e3d4089d05926e1e8911856cfc77d9a3
SHA1 0135fa39f92bf8e0fc8f151deb535daa3063f2fa
SHA512 319c28a1a4d79be167569e3718a354b9b60a75bfe2e4e014e86c3937d9aded3ab185493baa2b853a4253b688df9b610d27297558af5cae411e774e75d5be59d0
TLSH
T1B02180159D01AB78F94157BC61338226337089C68B98C1BD76F32487065BA95D8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads