af12c4ef35590f465c9d502d6dcbf9922e926bf9d332e033db305702ea6ec67a

Analysis

max time kernel
149s
max time network
176s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
04/05/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Slay_the_Spire.apk
Size 850.7MB
Sample260504-tdf2sae15v
SHA256 af12c4ef35590f465c9d502d6dcbf9922e926bf9d332e033db305702ea6ec67a
MD5 6c5a91c0d693ac77668c70842fa7b526
SHA1 9e0b1a679fff8362c58285bbb64bc42517f9bb67
SHA512 dbf97d0ac4e93287c1233f17d2e047ad8e0108bd6cd29fbf80ab362958a81adc566cc6cd1a7e199aa55362a8173083730dee5ba8577ba165e2ede8681499c49d
SSDEEP 12582912:z6BurevQylCekqazmDbQvlrovl8LtZsckaImDbavl8Nd10O+nuq:FegekqnDMvlEvl8BPkeDuvl1uq
TLSH
T1CB993721724AD10FD4448F75AD92D1FC3E7DBC0DED1981AB7AE24F3F4A7E248492A681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.humble.SlayTheSpire/files/PDALIFE.conf	4589	com.humble.SlayTheSpire

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.humble.SlayTheSpire

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.humble.SlayTheSpire

com.humble.SlayTheSpire
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4589

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

PDALIFE.vdex

Path /data/data/com.humble.SlayTheSpire/files/oat/x86_64/PDALIFE.vdex
Size 408B
SHA256 f198b628cf385d1fdfd5913f16622949ee54d6f4d6ab0b28b9f62c172e040beb
MD5 b051317ff235604120a4b90c1555b7fd
SHA1 11671a84ea88cc54ef189a377b1929f103144417
SHA512 c5fbbe3f288c7ff426a19f71ace7a367a5e0b44834074d48c0ebbc5326f14ea98e98f8fb61ff8820d75ad6ee5b1831e49ce48fe7b513b4e3e24e13ab7497f81b
TLSH
T1A6E0D85FD3786CB1E6F7E03450290102525260348521959A1F01BAA869E36F11E50958
MD5 SHA1 SHA512 TLSH

Submit Download

PDALIFE.conf

Path /data/user/0/com.humble.SlayTheSpire/files/PDALIFE.conf
Size 101KB
SHA256 a813bffdcff889a744ce5d59b3ce3c3f21480330bb9cb905d5c33e49e9089b19
MD5 a4b63eb04e479d9d25c1f53fec66384b
SHA1 e18b9a71007c49e24a4ea1093e685a8facb5bb28
SHA512 1d4f44a375a76cd2f7f6bcfa9e0c5eaca0a71e22bcb2ca8c9744056e2895093154fe0910540ea003cda62ac7fa6425685c7a1022f3d57842fc93e95237629832
SSDEEP 1536:Cu6dACIJEb3HlDEZB0yW5ODTU5wsOzkTfFRF6edLoIN2AE:oiCEWsB+sHywkzFaAFE
TLSH
T112A37A10E91A3BFADE70CE749D6A86436D2C81D251069ACECD1EF365BACF1F1444C4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Download