55b2b8f58d2e6b7eba70a2ea7e5dbd249cd0abb48f3d0841e3c4a0acc7c1b508

Analysis

max time kernel
59s
max time network
63s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
08/09/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Reigns-Beyond-v2-0-118-patched.apk
Size 152.6MB
Sample260908-3tw8daaa87
SHA256 55b2b8f58d2e6b7eba70a2ea7e5dbd249cd0abb48f3d0841e3c4a0acc7c1b508
MD5 f805196c576770619e094f0758fff66c
SHA1 a76ed8cf600b10cfd13bb169b70c1704ab1e377d
SHA512 b4b5546b8a6f334317b534ab5fe9e3f60deb283560b998e590f798abcba5b84823181a0e60c61f111691196926df90ff70e189aab1ecef874f56bb48fe147f33
SSDEEP 3145728:CRfv9Cr7x8db2Vmw28tJRVAiBHRJ6wKJtUTztfFrM7j6kRM:Qf1CrFFtJRVnRJSUT5FYjpRM
TLSH
T13878221DDE8F5744CBA952B0EDE14A20BA7E7843830D06BE06863E7118D5F747F274AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.devolver.reignsbeyond/files/PDALIFE.conf	4157	com.devolver.reignsbeyond

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.devolver.reignsbeyond

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.devolver.reignsbeyond

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.devolver.reignsbeyond

com.devolver.reignsbeyond
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4157

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

PDALIFE.vdex

Path /data/data/com.devolver.reignsbeyond/files/oat/x86_64/PDALIFE.vdex
Size 408B
SHA256 f198b628cf385d1fdfd5913f16622949ee54d6f4d6ab0b28b9f62c172e040beb
MD5 b051317ff235604120a4b90c1555b7fd
SHA1 11671a84ea88cc54ef189a377b1929f103144417
SHA512 c5fbbe3f288c7ff426a19f71ace7a367a5e0b44834074d48c0ebbc5326f14ea98e98f8fb61ff8820d75ad6ee5b1831e49ce48fe7b513b4e3e24e13ab7497f81b
TLSH
T1A6E0D85FD3786CB1E6F7E03450290102525260348521959A1F01BAA869E36F11E50958
MD5 SHA1 SHA512 TLSH

Submit Download

com.devolver.reignsbeyond.v2.playerprefs.xml

Path /data/data/com.devolver.reignsbeyond/shared_prefs/com.devolver.reignsbeyond.v2.playerprefs.xml
Size 129B
SHA256 9b1958617ed977bb53bcd9f7a16c7bd423e89adf9beb0f60105dfd865d31f141
MD5 6399d119f41e3cb4ecfd9ae569a0731d
SHA1 d166654957e6141d347f00257e195dee8afdc238
SHA512 fb07f7c51bacee3b43db118b7f72a233e8a06dfe6c068dd7dc89595e5ff55b33e8c86d5d821c276d7b2e7d3c76c90ad89fac57518f2ddd7610000c0606cb1f1f
TLSH
T1A9B02BF0D0F46D5259C0080544201A4422753663020838C05C23B4300FA8240026E110
MD5 SHA1 SHA512 TLSH

Submit Download

PDALIFE.conf

Path /data/user/0/com.devolver.reignsbeyond/files/PDALIFE.conf
Size 101KB
SHA256 a813bffdcff889a744ce5d59b3ce3c3f21480330bb9cb905d5c33e49e9089b19
MD5 a4b63eb04e479d9d25c1f53fec66384b
SHA1 e18b9a71007c49e24a4ea1093e685a8facb5bb28
SHA512 1d4f44a375a76cd2f7f6bcfa9e0c5eaca0a71e22bcb2ca8c9744056e2895093154fe0910540ea003cda62ac7fa6425685c7a1022f3d57842fc93e95237629832
SSDEEP 1536:Cu6dACIJEb3HlDEZB0yW5ODTU5wsOzkTfFRF6edLoIN2AE:oiCEWsB+sHywkzFaAFE
TLSH
T112A37A10E91A3BFADE70CE749D6A86436D2C81D251069ACECD1EF365BACF1F1444C4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads