d01edb217df2ee16b990e2e265773be876c410e20d3adfacd90c7c91e6a9d456

Analysis

max time kernel
73s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bitz_casino_7.3.apk
Size 5.2MB
Sample260910-ps3rwaxsc1
SHA256 d01edb217df2ee16b990e2e265773be876c410e20d3adfacd90c7c91e6a9d456
MD5 deb9245623c99e733b3dd749b30881a3
SHA1 4666333e93e220b156b4ad2fe1afcea553bd2615
SHA512 3b9e98a20ef12e7e468e07703f03340dfc4c6828bce2a0fb3096e98c1d7e6f3f2c00b97b2d2d74c3f57ba0333ccdb89bec06ac322d0603cd13137067d70df45e
SSDEEP 98304:JoZCVnj50pDxvdLdvPt8MG5Kz/Wdwk1Tt0rvF3/cPceFunlgDzdI:2Z+j5OVVLd35Gkz+I3/r9nlgDJI
TLSH
T1DE469C86E7889AEEC4F753760875562250474C26E74397C3A935327C28BB9EC0F4EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.bytefrontier.partner.a1win
/system/xbin/su	com.bytefrontier.partner.a1win

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4740	com.bytefrontier.partner.a1win
/system_ext/framework/androidx.window.sidecar.jar	4740	com.bytefrontier.partner.a1win

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.bytefrontier.partner.a1win

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bytefrontier.partner.a1win

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bytefrontier.partner.a1win

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.bytefrontier.partner.a1win

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.bytefrontier.partner.a1win

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.bytefrontier.partner.a1win

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.bytefrontier.partner.a1win

com.bytefrontier.partner.a1win
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4740

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events
Size 56KB
SHA256 42e489db879f4fd459e9b854dfe11f2448c4ec163e199f69aa1e9a9c47fd5440
MD5 64b16da43fc2b76994d9b178b9686590
SHA1 7ce0fe491b2affe2152f51eb724f9eeaba99f9a3
SHA512 8946a1765c4457395115b3c865dcae17c8f47449e119ab105588b3bc891b355ca7858306b686d7b7891ed25bcebf1c0628709a3995c9e2f123be8c3f03a17902
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSOrFXfb7tFXfbU:WMEqzAiwIyNjaOJb7jbU
TLSH
T12F43655D5A3C2221C66DF83DD7E243A32B7C83CF972292213D945DE6CDC206578254B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 45eba3c3f4e2640ee03cf092e184e7a10a69a4f682793a6c235c5d40d39f3022
MD5 66d0f96a5b71f0f74071b6b2f73d0986
SHA1 5ffb59233ec5eab9dc2d34688ccdceb52872564f
SHA512 e10f5dcf12c08ec4ceb36eaf714526db7d4ca9f550146de77da777794c3626a0bf747914b0b56145825f6941dcd4475f93a0f31e8916984794b8bd3a3452f8c3
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 77e9c1ede281b4822d7bc02c4c38f814c555f33945dbfc3a42cec4f70b2ae15c
MD5 fe8875fc6700dd2463ea8687b7feb374
SHA1 19e723f8165e88200b9573d35d1908f51d6c52af
SHA512 52fa513d97c84756c7de7876fd636347cb6d310a297e1e514738e92d86f6af59e0b469a77006bc66915fc37c0e33f4bf9994a52afdf82b2814db953061a46737
SSDEEP 6:7+/l9G8lFn1O+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKX:7+tg0K+WqLiuWdYRmBEyPbI
TLSH
T14402228873800812CD2916B7D0D983800D00E7288171CB1F1B9008982C076CCB4ACD08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e129b001c7b29dfd12f39d1a76c202a0bb37a51530367e63ce2f513d143a5886
MD5 5bc773cce0fe357481f9cb9c404baf6e
SHA1 bd1e0819f4862da337265690fff345344ded39f1
SHA512 4d5786c0ee77eeedb7c9ccee9e10391d936f1733a6a678930b468cbf302283950fec59fb1626bee38bf8e6d2209ebd966e936fa00db9ca3ff4e68b9ee3a07ca2
SSDEEP 6:7+/l9nGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKiPN9M/4Q:7+tMqLJdeWRmBEyPbTF9s4Q
TLSH
T14602228863400A13C039A777A0C983601E12A768A227CF5B17A108A82C8ABDDA898D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 a8d99afdadbe6c4965d9bf0da398a86fd0c85baff807bb2a1d71d28bf524eee5
MD5 9b7a08f39c565001795620a15226f33c
SHA1 4c146e6f80437735bcbe512f70a3d3e06e60cbc1
SHA512 28a062c014fe0cff9bb7f43bab791be05a9303fb4e61fb1379d2c5af6f6a12309d2f8ffa8ea7fa795f1bfaf1c5405be49cb74d0c43c088efc037a55814236e01
SSDEEP 48:7MK5eWqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS6:7/5eW9MEqzAiwIyNja6
TLSH
T16FB2675C5D3C2611C67E287ED7E242639D3C53DF9723A1603ED48CFA8DC2466B0355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 ede3d9488fdabdfd80d48538acba5967846f56e527bab6f14702894e3bae6b54
MD5 fa983b6729fb1718ea42f21485782151
SHA1 7ff6b6800362ac2b3436813141c7f7c89d61086f
SHA512 69f875285b40464162c809a790768474c45910b722d47f0ea5d36ecb6a037820147d5381bee61306a566d94e0670cffaeb1bc68998fe680df5e5e3cdf4b3b654
SSDEEP 96:7g0zXDINhb2D1Y9Sto9StcnGpytMEqzAiwIyNjaU:7Yn2DGkKkGGkX3l
TLSH
T1F972D84CA92C2231C2EDB57DE7E256231E3C139F6A23606479E8CDE88EC606D703645A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.bytefrontier.partner.a1win/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 11cb1db24da334a227b5f201b772987759f60e0975c8ccb7b04174ca9ceef51e
MD5 4ab84de2c670b8f9dde20dd0a8bbe4d2
SHA1 c5afd95a9b38cb764ba4233b5abdff6ed2ad2130
SHA512 aaad09baa9e8742b1e459f161a28dc2c9bd612ea44fb5c05016ead144b100c57128d63e8244e90edf1cba1b8a1cd73e94be347ca0b478655067442017f47dc05
SSDEEP 96:7GHb3NMEqzAiwIyNja1MdMEqzAiwIyNjau:7ab333kMn3n
TLSH
T12992645D593C2311C6BE283ED7E243A35D3C53DF572391603EA49CEACDC246AB0255A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 71148a2f1823f6aaa1e6c71dae3baa877d2ce3fb770d9e6fd330cb9405eae3f7
MD5 4d23af158f55afa65c1d4ea81e428600
SHA1 aff563a82123dc377e4260c0fdc2ddaf61e86262
SHA512 d6d2eed184bf8de2d663f98799524275cb4ea0888f31a55aff900a5fced71229c1e9a9d2efda42e25b54e598afea2a1880c2b31e64412087130e7647b82deb5d
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6BBSvL:TLwHmz3GSP/DvJlF44
TLSH
T10E722BCC9E10E603E23B073A60CB93D61E38611E43679A5B3A7509649D532C8F152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 23b2290def28e780c32e43120a1e9e9388354bfcf963a2bac4f1fed830fee5da
MD5 3bb3ed8a41bdbfc882cb29e930161d63
SHA1 a6725a9109ffafdef419d07e9dd174fb6c360f0f
SHA512 67f6dcfa403029fb9469bd02a1cca5bf11d20006f46d02220077c70435c2279dabbeef2c25a36f5d50ec50d806bc1f193f2b9c87f1b4599350f98322a55b9752
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFl7O5vJ+/0Fl6BBSvL:TL6fHmz3GSP/h7499Fk5vJlF44
TLSH
T13072F689AA24D653E23B073960C7D3D22939715A0767DA167A254A2C5D433C8B161F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 05b65a9703c8875f3b4d06250350b49aeabecfb3d495484075d7a0bae471ee6f
MD5 1e0e73aa410201f20fb68fee48c77c58
SHA1 0bcabc5c15a7477588f75da935f4602450b62a10
SHA512 6d2ad4d1594c2d8c1ab08d4ed172c0d913af6525b0f7bdcfffaebb9553834633ff16b27b48fa70b6538a62d4f0afd65009c79b2c5ac81c660d15910254c64036
SSDEEP 24:TLQHmz3GSP/F/PKabCCbH499Fk5vJlF44:T0GKSP/FKabCCbY5kV144
TLSH
T10F729788B964D692F27B0B3D11C7E3D22A3D31AB0723E7033E665B2C6D43380A121F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 4d07a7fc5f313c4555fddb0eae4937df2d9baf2931241812519db6cba5a83c71
MD5 5f459c98a68ef32d304d0f5c6e805b20
SHA1 09145ed3e24f5aa5a9656f6a9ca5b1fc748312f0
SHA512 ee1ac7e2964ee59021c79bfe41a41e43d57964dcf9b78b79501bd8b4dd99bba8f456468b31da04a4c1c0d3b13f50029f6b412aac4ccdf2ccfbbce5e7693dd4ca
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbH499Fk5vJlF4G:TkGKSP/u8abCCbY5kV14G
TLSH
T14A726488B968D692F23B0A3D61C2E3D22A3D31A70323E6027A225B1C6D03380A221F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bytefrontier.partner.a1win/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download