753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494

Analysis

max time kernel
46s
max time network
143s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.ea.game.pvz2_.apk
Size 4.0MB
Sample260930-lfxtbabf76
SHA256 753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494
MD5 af6f731cd1658877e5bb2c9e985d969a
SHA1 ef342f82fdb71ef841322c543a7a2080fb535bef
SHA512 1b735e97b6ef60083991336f0e1c2d2bf477286910bf7017825a514529b1411e9fd14d2a6510165c66cbd3948f2597a0cdf7dd0239f913101b45b27d0c9ada82
SSDEEP 98304:8JB/IQpnI/VV17GqIgi8Hz2ZmTRBxPQPAZgL4rj7:8V0hGbgi8TFPPL
TLSH
T12D16019AF74CA03FD97B643249BA5225A2974C034DC3AF833944761C29BB5845F6EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/su	com.ea.game.pvz2_
/data/local/xbin/su	com.ea.game.pvz2_
/data/local/bin/su	com.ea.game.pvz2_
/system/bin/failsafe/su	com.ea.game.pvz2_
/system/app/Superuser.apk	com.ea.game.pvz2_
/system/xbin/su	com.ea.game.pvz2_
/sbin/su	com.ea.game.pvz2_
/system/bin/su	com.ea.game.pvz2_
/system/sd/xbin/su	com.ea.game.pvz2_

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ea.game.pvz2_/code_cache/.	5087	com.ea.game.pvz2_
/data/user/0/com.ea.game.pvz2_/code_cache/.	5087	com.ea.game.pvz2_

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ea.game.pvz2_

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ea.game.pvz2_

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ea.game.pvz2_

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ea.game.pvz2_

Checks the presence of a debugger
defense_evasion

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ea.game.pvz2_

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ea.game.pvz2_

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ea.game.pvz2_

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ea.game.pvz2_

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ea.game.pvz2_

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ea.game.pvz2_

com.ea.game.pvz2_
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5087

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/com.ea.game.pvz2_/code_cache/.
Size 13KB
SHA256 d8e74319d85ca306fe36b234f44c0168f12dcb52ea13bb9d840612ba6e8a7779
MD5 d696946452647de54c18534e4b8ceebc
SHA1 e8984757129f18179fd525fff7066237265b6c10
SHA512 b02178eb3d8876cacd517cc03b0216605df512ca05e71fff52c354f6d76a6f57a9e316198477a0175657b4949bfdc5970de437d1b60725738d976b15b5f76487
SSDEEP 384:JBGiD4LtMGbqVfvL04IdemVgJx4qCFs2XXT/l8Ma:2g4mGuVLKWJWrFrp3a
TLSH
T1E652CF339AB28867DC7381F1EE8E5639B41A148B14F790F62A306848F5FE1D514E77B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /data/data/com.ea.game.pvz2_/code_cache/.
Size 7KB
SHA256 401001b75bfc99f2581963dbec0f63322815ba9ed2d08aeb9acc10f47bd9df4d
MD5 3e93ca70221b5acd7699cbbb3e2ebfdc
SHA1 123829a7bc287055dfcb170111e6afaa02057cd9
SHA512 44c7dbeacf6c661a92931e98ff3b1fd1abd39c9ca7f498f12abed5dbbb79c940770b5f83a2966f9e08658018f184d145109132a0858214b3ef2cf8dee128c7d1
SSDEEP 192:B/p2ozpUrvtXrNrA698X8DGRT6fwtAduLYeHnBLoR:Fp2S6Xr1798sDEGYyQQ
TLSH
T1D3F18D4829A32CF9DEC20A71AFC7524545DF66C5CED989A80DB880CFCF53919C9B9C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
TLSH
T1D8337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 512B
SHA256 8a63c970ed97dd360a6530dd11884f8283f8c012e66dcf4f7c9c81be44e952ff
MD5 1e5f02554333c89d94166519f27fcd08
SHA1 1ad3c88937fac01810595b6cee792fbd67bef026
SHA512 3930bf19956fa8e85a326cb793797abcafd0d36747f8a2523f119a68074f18222e660582f7e40e86e28e47214c0c0c38560ba41ce97c6b12b739676d55cc65d5
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 87f8fac7c44cb6a23d13a88d71fd660401df67cf4b2fddffb37737279801b039
MD5 94b79ddaa407509107dbccf179bedb14
SHA1 c612fe4f8c00e781d9adeb2bd6d77ef01620cc15
SHA512 7cf9160f60f05eff23ce6688caf8e5c452e3136dc9a4a88a93e4dd397f11f98fd1cd6c1a6084a7d840d58633a8b151c873b45b64db8db530197d63a39abb6258
SSDEEP 6:7+/l992n1+yg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKmf:7+tRyqLiuWdwRmBEyPbXf
TLSH
T1A302229973820A23CA1916FBD0E483400D00E71E8561CB2B35600AD83C438CCE4E0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 c69412fbf993c61bd1aa2bb7caffceb293ee26f9c7f2bd85ea3851a890d2cec4
MD5 d704b8f3e964194756c47e3587484a18
SHA1 7acb2bac8a063113fe305f1987758102e11d05fd
SHA512 5459b074886b1fc1d0f2743682b3f09fb87cb044eee0d752a09a7c45c5b7cc4d9d64a3b36b7ff925f839e970b7eeb8f36b1459d4abfc61cb876de417d7194da6
SSDEEP 6:7+/l9x/SFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKmkl//73:7+tvSBqLJdTRmBEyPbnsX73
TLSH
T1C102128967410913C5199BB790D9C355AF60AB25C373CB5717600898BC466CCA894D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events
Size 56KB
SHA256 7eed7e4095cd2f128f12ebe795e2fae703b75494d4c87a96c13ff34405fbef7b
MD5 7623d961f14ac6075eaf0cdfec785b0b
SHA1 083030ea01376c74772d8b37930d71b80d35f5fe
SHA512 e092204c43606139a59c56c527e776fbafed876891b2cec6168ac84b31681213c696be7483a295a3c9ff335725801f6d2aee31a7ef43582843fb324685f3907c
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS4:8MEX0wIyNja4
TLSH
T16643839D1E2C2220C57E283EC3E143635B7C93DF1723936239948CF98DC202974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 b23c22782905173dbecd6768e11d8431411bfe6ec4ff6090984df5ddeecf272d
MD5 e97faa7cc84b4625ec0560034a13a3f9
SHA1 c6980ddc8113440c13c8ee17d5d9c6a71dfb223e
SHA512 60b9844123dab46977120cd9440bc0657805e6d9ca6b895096f820d50635e689a3049cee23c00181b4c8e4bc034624bce40b039fd6b3ed70052f117664302af5
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 120513ba780ff31970b0e525b6fb391caac2ea8210d1e820bb0a45944df8a257
MD5 ceaf9042d784db0dffdbc4b094a3623f
SHA1 7346e9656c49a72465a9487201d40691baa0c67c
SHA512 151ef0188fcadf136ff1c79cb0b49a04b19646d2d3cbfbfa454cd22019164353b03700d1e333b3bd44ae83275ecf28c1da9f5488cc9ce368187d0a16b41e9d1b
SSDEEP 6:7+/l95Ytn1+FMxvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKiRn:7+t8WMRqLiuWdwRmBEyPbTRn
TLSH
T1EC02229D7B801922CA1D16B790D483900D00F71991E1CB271AA0089C3C435CCECE0E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c4a877aec8d1d5d87710139765106015791327f7d3231d1e53eeb3cee49f4556
MD5 26f069689d6cb1822b3378f40ffc94d5
SHA1 eafa315b263de60b3e56ae7924348f987f06eaff
SHA512 de566b69073fbbb786fc29806b068cddd1c2681801f9b601e769d72da0ede06bcbe4a5abd30ae9ec37d5d2bea78dded1a6a532ee422c0cc8613657d0276bd62f
SSDEEP 6:7+/l9W4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKc1/K:7+tYwqLJdTRmBEyPbVK
TLSH
T1990212CA67420913C51957B7D0D9C3552E51A715836BCB5716600898BC47ACCE890D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 62d39f7b0564a17f9447497d5491e5b435b758beddfe0358c41fc8035c257020
MD5 10e7e1ffa5355c31d8b833668895b31b
SHA1 0b37eea2be1282812f84589b14738fd79ae85a3c
SHA512 e96fd3ec8b641642014176fdfbdaa5b6d211ddd0f4faf005baf3b9103aec505940b3a15fbe35325df26f0a52e1b8e57f481958159db754611df97285d4f9c529
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6mTp:TLiEy9zmzrfRmBEyPbP/P+/0Fl6mTp7
TLSH
T1E4726FCEBB206703D2734776B0CF93E22C30A2188323DA0BBB541478AD42288A092F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 e40e6f524be55d374563b3015da18e7b2a598570635bf3db8bcdf275d3a7ab98
MD5 06d02645763f962926113befc50359c5
SHA1 94149e6cbfec022e50347ba687884046608c40ac
SHA512 fd1e05102354786f15b7d50b70e636d3559f334cda47a788d2f2b31b2911f90c5f83b7e5284774057711a2fe5e721237c3d0c10a704bdf95d32a6c2b78ae98d5
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFl0X+/0Fl6mTp7:TLQpmzr0GSP/h1499F8lF5l
TLSH
T1DD72598E7B24A703E6330B3560CBD3D16C35B2155723D60779012A2C6D423859022F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 655cc688c7b384aaae31aea008dee544aa52b5d592c94acbb6dd6523a9b160ca
MD5 45a531b61d47c77b45159b399403a862
SHA1 34db32dedcc40e8ce9d245f6731ff573bfc39849
SHA512 ed16141974fb52783d471ab04800fba1ff49459ba7f9a78830e9b03ac795295f32dadef6af7971a5f5d4b39a61af05f3f79009d2562b6c0f5159891847554d5e
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/ZRhOLavnOAU7wU7UyWlEdX49blqYFl0X+/0Fl6mTp7:TLEvpmzr0GSP/nhKamNZ2A499F8lF5l
TLSH
T1217226CAB6A8E602F6774B3961CFD3D22C39B1965723D213BD066B1C2E427828161F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 156d2c25a25554dd25fb1180a692df1342f045cda4decc704ff93663e19e9939
MD5 71b9755c1cef899d8667e777ffebc8f7
SHA1 56c22bc5993a12c8886de370814cac572102c8c3
SHA512 9c3f657eb41fd79bd7fec73fe04df19effa908e2c8a066f9f8e2cef91a4680d45061f60cd6b73b32238e5c9f79b713ab0612d9ee61bd2777b823891b9cea6b07
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/MDRhOLavnOAU7wU7UyWlEdX49blqYFl0X+/0Fl6mTpv:TL6Xpmzr0GSP/M9hKamNZ2A499F8lF5V
TLSH
T1A072F7C9B668E602F6734B3961CBD3C12C39B1565723D613B9066B1C2D423828061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 dda41005f2be5c6ed5ea7a73e66d4183108cdd373e2135580ece96a8685e37f4
MD5 cc2044371b208dcffc71b851a9315d29
SHA1 5d2576d707ca0531919708bbcc90c46c463fd15c
SHA512 354b3481c7ff47db128f533601cfed968241c759a229ec8a0a6be0c7e966340cc05f13a1af22b6ce103a31ebe89112918a100f88078881f346a4226c9650ac16
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W8mbl:TL6EK9zmzrfRmBEyPbP/W8al
TLSH
T13B72C28E9F102602C6660676B4CD93616D14E229833BAA572AA80464AD4254AA092F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download