d01edb217df2ee16b990e2e265773be876c410e20d3adfacd90c7c91e6a9d456

Analysis

max time kernel
144s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/09/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bitz_casino_7.3.apk
Size 5.2MB
Sample260910-l8brjsge35
SHA256 d01edb217df2ee16b990e2e265773be876c410e20d3adfacd90c7c91e6a9d456
MD5 deb9245623c99e733b3dd749b30881a3
SHA1 4666333e93e220b156b4ad2fe1afcea553bd2615
SHA512 3b9e98a20ef12e7e468e07703f03340dfc4c6828bce2a0fb3096e98c1d7e6f3f2c00b97b2d2d74c3f57ba0333ccdb89bec06ac322d0603cd13137067d70df45e
SSDEEP 98304:JoZCVnj50pDxvdLdvPt8MG5Kz/Wdwk1Tt0rvF3/cPceFunlgDzdI:2Z+j5OVVLd35Gkz+I3/r9nlgDJI
TLSH
T1DE469C86E7889AEEC4F753760875562250474C26E74397C3A935327C28BB9EC0F4EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.bytefrontier.partner.a1win
/system/xbin/su	com.bytefrontier.partner.a1win

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4891	com.bytefrontier.partner.a1win
/system_ext/framework/androidx.window.sidecar.jar	4891	com.bytefrontier.partner.a1win

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.bytefrontier.partner.a1win

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bytefrontier.partner.a1win

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bytefrontier.partner.a1win

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.bytefrontier.partner.a1win

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.bytefrontier.partner.a1win

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.bytefrontier.partner.a1win

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.bytefrontier.partner.a1win

com.bytefrontier.partner.a1win
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4891

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events
Size 56KB
SHA256 92909207740d13a7f082259f7bff6a77bc8a3ef6f3c1d584e0cc968412a8e352
MD5 3df132a1ff182fa0b6ad7516ca1b2f0e
SHA1 1fca4669e570d74db1a3c433d470e886e491154a
SHA512 08379e86956b4d3ca9c6e77668453331c3289b1c33656074009cce176693d8f6dbf6729ac479d33fd1cc36c58c920cb96235324e1957639e6a6c61067b5b4ce1
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSUNdFXfb7tFXfbI:WMEqzAiwIyNja6zb7jbI
TLSH
T1DE43649D5A3C2221C66DF83DD7E243A32B7C83CF9722922139949DE6CDC206578254B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 79b49ee06a3adb6f0e1509cd1f957442261e78b86e9bda8a3603850e6285f8b2
MD5 36f4d14fdac4cf775ca48ec9b1e63848
SHA1 aaba54a29df3d9adc45e70a927240a1116858f5c
SHA512 aaa034c91fc2a53559c3770bfbdfbc62ec185b9e84fef6d585f2ec8d230fdb5d3eb96a0a392855c29d64ccc450060a144506598049b8e1fde000b69e0bb9ef0b
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 3fc1288029a741fc18575a267b8d9fdcaa0ffb4131ef546617e382b9a40b2b4c
MD5 474d1434677c707803ceb80a3137f3e1
SHA1 4fdfb062201d4efed479bfc195cd79c9335de337
SHA512 a3585a919fe5a24718602a9d8d6bac57e55378afd74431ff9b78efa5138520f7c1594ac0c18cb67b94591e36b294a90b50cc614a4c4e6381f664413b0c3be61f
SSDEEP 48:7MWNxqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSH:7Rx9MEqzAiwIyNjaH
TLSH
T109B2855C5D3C2320C6BE283ED7E142635E3C53DF5723A5603EA48DEA8DC6469B1394AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e6ddc1d905f23e5c7c97367795bbdb7aa9acf867c6cf8e4fbf2339df7a4f7164
MD5 c05d5faeced39a8054b6b3c42f445c16
SHA1 bdce46bc16e458c68233fde2e3330ad356f7e72f
SHA512 711aa50c59f1e6cf8f38e3acd690caa9fa518bbf6ff1d1eff5a85fdbbf54aca372fad4e28cda17e7b7a13a196b9fc901fe6b81bfb240bd1884cbaebf8b704a6a
SSDEEP 6:7+/l9E7jgn16r/ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK7:7+torfqLiuWdYRmBEyPbI
TLSH
T19B02C08F67820813C82F177B90D483800D10E7388571CB1716A208943CCB4CCF4E0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 0f338300b9e02d4670978ab7fd88ba282c815b9db894be4a8167af651645b4b8
MD5 a8ddc9bdd9be297bb8823f5468e89769
SHA1 c4deac53385791d3f0661fe32758487b7346f0d8
SHA512 8ae2ebff8cda9ef4eaf4cfe234bf939c2770c614d1203f49e993adea8a8b46bb7e9569a900bc44d71adeb65c65b47b539bb9f94203e6993db8e4072d75eb22a6
SSDEEP 96:7qu7qFxD42z0j2D1Y9Sgo9Sg9nGpltMEqzAiwIyNjai:7BshIj2DGkfkYGjX3v
TLSH
T18772EB9DA93C2222C2EDF57DE7E106131E3C139F5633602879E8CDA98EC606DB126566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 a6f9ea624342fa63716a7ae1c0ffba76d686d82e0609f4efeec9ece6ae6acc78
MD5 3b66cb385b7529e51bb5b67e092c2ee5
SHA1 34667d0e2ffb202ecaa7aef919488b18e3bf3d0e
SHA512 422fd2e148cd522ebdd88a9bc65d462886f05851c62f3ec74991efdc5027d475e21fed83d9131b74c40b9c1af7860f88ca5db9a6f7d81dd7cc5048d8c1575f1d
SSDEEP 48:7M3VFXfb1qW59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSJVpqTq59MENkMw+:7Eb1NMEqzAiwIyNjahdMEqzAiwIyNjaA
TLSH
T12792A59D5D3C2311C6BE283ED3E243A35E3C53DF572391603EA48CEACDC2469B1250AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 52d829a058cd1fd96d8b56fb18f275d771e39fae5571c092d05347cd9ce7dade
MD5 c823d13b022de7e14f523e8374d28762
SHA1 02e1213289149361be5ad0b76cd69b5c062cecdb
SHA512 6d3a1d6ea977ee1ca71741620364c02cdd3e739444cf0e8fcc9d07fd648aa8cc615d9b4d05ef7e7d87cb44ca39669354798badf16b65bbd1ac394cf64e5a3e7d
SSDEEP 6:7+/l9wgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKHnM/4:7+te4qLJdeWRmBEyPbWns4
TLSH
T13202228863C00803C62B9777A4D883A01E18B7289333CF0B269108543C0B6CCA890D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 f11fa214148e48e6a68cbd5875a124cd7d253e1c01cde7dba90f25330df3ebd8
MD5 4620dffd6d1709626ce9fce2e685ea6b
SHA1 ca43bf5cb52b040c7748b999dc36cbc7f76b3562
SHA512 66dda55f7f6562ccdcdb4a1c62b7a1556744b76ed0afe2c140104a54f9663e8bd35a7360c13c2a1ae412ab975e23e32d4e86535242be2fa3127952ffd8ccd8fc
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl63uPL:TLwHmz3GSP/DvJlFr
TLSH
T1D2722BCC6E10E607E22B073A60CB93E61E38611E5367A65B3A6509749D532C8B152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 b70adeb46de8826bde5b12c87c6b7571c88ffc09f6b298bbae8472190ed49114
MD5 d0ee2cb0e6f070f4cb6d8aec4abc0e02
SHA1 0db494d0081870e63d8aa500148bcb8f8ec6ff21
SHA512 c17b0ec101472186c078f25d6a9b29c1bdaf12911b7ad48f9a50e2f9175cc96e58b99b60962863cbd664a3cecde6f019e44a25f4cfc5a00564f1714ce8852e7f
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlO/uodvJ+/0Fl63uPL:TL6fHmz3GSP/h7499FwtvJlFr
TLSH
T19E722B99BA24E693E33B073D21C7E7D6293C311F07A7A6167A154B3C5D833C9A161F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 a54118d3394b7f8a6f6024dd0daaceab349c540a041c9973da95eb8cd9e725a5
MD5 c1243048c2624e8e9e6fbd775c9f5350
SHA1 a3fd9853c66baf9e9c3cb547167136b4bb3da239
SHA512 06a81c48975aa0862e22b4b4652f02cd0879ca97bba240464e2a4e11d5fcade4cff11ee940224f5c13373782cc3c64560ab669bc42ac430bb19381689e63dfe4
SSDEEP 24:TLQHmz3GSP/F/PKabCCbal499FwtvJlFr:T0GKSP/FKabCCbai5e1r
TLSH
T1D0726888BA64D652F27B0B3C12C7E6D6293C306B07A7E2123D069B2C6D83384A261B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 ddadc10d2b0abb8997f0564d108a50f2372ddd460f47141ceac86c3dcaf2744b
MD5 d49519e1fd475bd0202c022e810ae63c
SHA1 f70332a655e989b93c7d5b7bc29cd226ff9d51cc
SHA512 6ecbdf0b8579e4bd6396169f750caf34333df6c891f8a3227e07d0edb175f2b1c2a01c5882ad52b39431bdf66dcf98b4c6f6f9938bf50c6d241b4240f091d8d3
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbal499FwtvJlFJ:TkGKSP/u8abCCbai5e1J
TLSH
T1B9726888BA68D652F27B0B3C22C2E6D2293C306707A7E21279069B1C6D433C4A261B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download