Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    29/06/2026, 11:42

General

  • Target
    angry-birds-classic-8-0-3.apk
  • Size 98.6MB
  • Sample260629-nt6pgscs2t
  • SHA256 0d533148bde4e2067f9138736dde22e49dcc6d7191d20d5061e2afb7dd35b75d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.rovio.angrybirds
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4722

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .YFlurrySenderIndex.info.AnalyticsData_6ST4H2B8QFCXV55FS38F_234

        • Path /data/user/0/com.rovio.angrybirds/files/.YFlurrySenderIndex.info.AnalyticsData_6ST4H2B8QFCXV55FS38F_234
        • Size 88B
        • SHA256 33d8d4caaf9d4b6f900941aced5fbe93134bc1a231f790378261a89a4d4a0b8f
        • MD5 SHA1 SHA512 TLSH

        .YFlurrySenderIndex.info.AnalyticsMain

        • Path /data/user/0/com.rovio.angrybirds/files/.YFlurrySenderIndex.info.AnalyticsMain
        • Size 72B
        • SHA256 1c57bcbadb1a17a7556552f65e8534f10f09ac9b71fe2f5e25b38f2f6e40a5b9
        • MD5 SHA1 SHA512 TLSH

        .yflurrydatasenderblock.f6687ea0-e90e-4bf4-ac43-ff7ce889cb9b

        • Path /data/user/0/com.rovio.angrybirds/files/.yflurrydatasenderblock.f6687ea0-e90e-4bf4-ac43-ff7ce889cb9b
        • Size 328B
        • SHA256 266cc932c2d0ccb1054631e1d89a4eaec6a937bb6c7bc0265e708ad011f4bf87
        • MD5 SHA1 SHA512 TLSH

        A733F7B2DE0F7B2A65240A8AEE77B8C8057AFC525GC1.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/A733F7B2DE0F7B2A65240A8AEE77B8C8057AFC525GC1.tmp
        • Size 272B
        • SHA256 715d1699a344f641b0b6a6e7aa095ada7eff149742f7c797b764b492546e00f0
        • MD5 SHA1 SHA512 TLSH

        A733F7B2DE0F7B2A65240A8AEE77B8C8057AFC525GC1.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/A733F7B2DE0F7B2A65240A8AEE77B8C8057AFC525GC1.tmp
        • Size 272B
        • SHA256 66c3810756b6e77b2852db6e4ef218d16319d0cf39db52480c7672c10292dd46
        • MD5 SHA1 SHA512 TLSH

        daily_challenge.json.tmp (deleted)

        • Path /data/user/0/com.rovio.angrybirds/files/assets_service/daily_challenge.json.tmp (deleted)
        • Size 251KB
        • SHA256 5c664fdb0f5a96c3130243206693710a6cfe9a410700657bba2c551c7c547713
        • MD5 SHA1 SHA512 SSDEEP TLSH

        force_update.zip.tmp (deleted)

        • Path /data/user/0/com.rovio.angrybirds/files/assets_service/force_update.zip.tmp (deleted)
        • Size 282B
        • SHA256 9ef9a6d93e065df6ff22027db7c1e730359d4b5a087dabb0f3d4e73dee67f618
        • MD5 SHA1 SHA512 TLSH

        ugc.zip.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/assets_service/ugc.zip.tmp
        • Size 956KB
        • SHA256 e87ded008f5b37f3bb624d8b331829660121ba88ee9350aff906c5cafd7a1e22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bi_data.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/bi_data.lua.tmp
        • Size 144B
        • SHA256 6b5440f927b46091be3eeb8d0f71417ac1ea9f849cfa596ae247c415011ace4c
        • MD5 SHA1 SHA512 TLSH

        cacert.pem.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/cacert.pem.tmp
        • Size 203KB
        • SHA256 9bca72498a6e3748706f12a380885c9d54d93afdbb18a8d690ecd3c61fdc1d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 6b433dfcb9c4c1beab77017384d724af73a792922c55619bcab210d5bf70195e
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 7c6566f63b33d4e79bfbd4350c8bcb670e1bec1e1ffca330b838831625daf0c5
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 9495b4978bf922f3c1790c0c9b5745c784996385540b7019801ed9de101b2026
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 39fa034661ee8896014c207a7f89362b3dca0a7e94f04e8bf30f845853677cf1
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 adcb02efba96245351c4267b65c9e84db81c1c18166d2eead9bc00c36d2a4e59
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 4909e03f7a1c2e62c848dc7254eba9de9df303e01ac10e176ffb813757fa9c82
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 5aad972d242a5410021f5b67f20ac5ec140a9eb4a43ddd8873bffe7d7ed994b2
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 80B
        • SHA256 a61e941771e9528399f4d92767d20866132fb624981e70c0236ff5b2fc7dd350
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 ba40de3717626bcd9f0a896d69a89177eb03dcec1d70ee39d9e360d825f1db4b
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 d741f645e5a620f26dc40f709128896091ddbd475e87748bb6f85ec838e04f4c
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 67a234c8e4fbef479f2f42e40859bc02eeda9720d49c81bc1bb553403fbbb082
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 224B
        • SHA256 c69065d4957546dc979cf1f12d8e1b38219a2c37b511be79da52331741fcf9cc
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 1KB
        • SHA256 0dc729586edc1e0b91b62da1453c7db0b19424d4511635bbe0f84d0a0b090b14
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 1KB
        • SHA256 ada2f02ce37a0a4772b3f513a45f414ca1d469cf42e059193710151b49018e7f
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 2KB
        • SHA256 7a8b7204b7b645d967af8732903214c261e5257366fd18d4951d141d133dc948
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 4KB
        • SHA256 65025bde6e9ea1fea39a424e851d142eeaf61b44dc851415a4d4d45284f58e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 4KB
        • SHA256 6faed63a9e3d9a03efdbb5ba736f9b26827e39234ecc2556db3fb9ad8e96f479
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 4KB
        • SHA256 8b72fb61c28fde0f41f110a4baf45a3699037fa3566181098494c718da1a5e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 128B
        • SHA256 701607be55955f965134bb0df8e7000cb418e69970e95069c6293eaf5fe27bbb
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 4KB
        • SHA256 5c134e2bdf938316307a541b48154527c94b7c47afa6646f99ed36a25472b849
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 6KB
        • SHA256 459f33c696e710561db74a9c47740fe1c24348d31b387580d81db6670c88dadc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 6KB
        • SHA256 0c093ead0394e484aa75c1a0d58ce570b026c52dc36458d64dfdd5a183c8c1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 6KB
        • SHA256 43ae1fcc5a736dbef4db7e82dde93427311652a6a616b124047da8af5b92ba42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 128B
        • SHA256 33323d21024e49aafb9e252a6b63d8d8775ec7466b6b354bd82e0f222264754f
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 6KB
        • SHA256 dc7888216b71cba0c417d27623bf18768de5a4251a0980284ffb3ac5d8103475
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 6KB
        • SHA256 9a18d0772a05655406f5f5029c07309298d808c23354307cb97d796da7015268
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 128B
        • SHA256 0eb68e0f5d2021a89050046373627a17382caff152e01ca8a51ecb70ba7eb786
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 128B
        • SHA256 35af8f517a6f92b36ea7f57457fe1e91fcd3965d27285dd335d3b49a46fb1a2a
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 192B
        • SHA256 62455255ec296058edec4960b24eaac2bf3e72d25ab1fb351ce6bd386426d694
        • MD5 SHA1 SHA512 TLSH

        fusion.registry.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/fusion.registry.tmp
        • Size 192B
        • SHA256 b71a13187c5845c94ca650b4d26c58ca4a1910e170c83255f1d33da4cf4bbfeb
        • MD5 SHA1 SHA512 TLSH

        highscores.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/highscores.lua.tmp
        • Size 16B
        • SHA256 87aaa7fe3f442afd99dd4a616eba742f416bce20fd0c2bc7299fb944a2b5970f
        • MD5 SHA1 SHA512

        498e2675-ad4e-4357-9f36-8a19851e8ac9

        • Path /data/user/0/com.rovio.angrybirds/files/net.hockeyapp.android/telemetry/498e2675-ad4e-4357-9f36-8a19851e8ac9
        • Size 805B
        • SHA256 55a60691fcfdd974e2d196434bc263e4330e17c806400831957dbcc4e97a775f
        • MD5 SHA1 SHA512 TLSH

        rcs_analog.pb.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/rcs_analog.pb.tmp
        • Size 1KB
        • SHA256 c2e701e5919619948892492ee38540dc014a04a5d73ed9f3117ff93091ad0fbc
        • MD5 SHA1 SHA512 TLSH

        settings.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/settings.lua.tmp
        • Size 352B
        • SHA256 3db3462032fe1f200ae6b5533b4c50a0145be254e62afe54a30c8ea9070fc198
        • MD5 SHA1 SHA512 TLSH

        settings.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/settings.lua.tmp
        • Size 560B
        • SHA256 052abd5441857f8179746ce7ac295ade0701f46988a9a87e248beab028e4bffb
        • MD5 SHA1 SHA512 TLSH

        settings.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/settings.lua.tmp
        • Size 624B
        • SHA256 14ac2e96a25973b336af52f70f70ae14f71f4a176d148be3afcf874425a03009
        • MD5 SHA1 SHA512 TLSH

        settings.lua.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/settings.lua.tmp
        • Size 944B
        • SHA256 308aaa6a98f6b264c1f607e4122b3043cf44eaa994efc2a138d7c908e46eab57
        • MD5 SHA1 SHA512 TLSH

        skynest_storage_hashes_BC80198A382800C8F073D18ED6D8FE595FDF476ACCCAB72623F97AA1BAC52A5A.tmp

        • Path /data/user/0/com.rovio.angrybirds/files/skynest_storage_hashes_BC80198A382800C8F073D18ED6D8FE595FDF476ACCCAB72623F97AA1BAC52A5A.tmp
        • Size 48B
        • SHA256 77d9bd75873aa80326bb77385bde1cdfe4918390cd1ef8a7bfb443798701be07
        • MD5 SHA1 SHA512