753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494

Analysis

max time kernel
119s
max time network
153s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.ea.game.pvz2_.apk
Size 4.0MB
Sample260930-lfxtbabf76
SHA256 753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494
MD5 af6f731cd1658877e5bb2c9e985d969a
SHA1 ef342f82fdb71ef841322c543a7a2080fb535bef
SHA512 1b735e97b6ef60083991336f0e1c2d2bf477286910bf7017825a514529b1411e9fd14d2a6510165c66cbd3948f2597a0cdf7dd0239f913101b45b27d0c9ada82
SSDEEP 98304:8JB/IQpnI/VV17GqIgi8Hz2ZmTRBxPQPAZgL4rj7:8V0hGbgi8TFPPL
TLSH
T12D16019AF74CA03FD97B643249BA5225A2974C034DC3AF833944761C29BB5845F6EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.ea.game.pvz2_
/system/sd/xbin/su	com.ea.game.pvz2_
/system/bin/failsafe/su	com.ea.game.pvz2_
/data/local/su	com.ea.game.pvz2_
/system/app/Superuser.apk	com.ea.game.pvz2_
/system/xbin/su	com.ea.game.pvz2_
/system/bin/su	com.ea.game.pvz2_
/data/local/xbin/su	com.ea.game.pvz2_
/data/local/bin/su	com.ea.game.pvz2_

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.ea.game.pvz2_

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ea.game.pvz2_/[email protected]	4483	com.ea.game.pvz2_
/data/user/0/com.ea.game.pvz2_/[email protected]	4483	com.ea.game.pvz2_

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ea.game.pvz2_

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ea.game.pvz2_

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ea.game.pvz2_

Checks the presence of a debugger
defense_evasion

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ea.game.pvz2_

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ea.game.pvz2_

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ea.game.pvz2_

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ea.game.pvz2_

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ea.game.pvz2_

com.ea.game.pvz2_
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4483

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.4483.tmp

Path /data/data/com.ea.game.pvz2_/cache/oat_primary/x86_64/base.4483.tmp
Size 428KB
SHA256 7363343af6bd1f5134c10f917d62a80f23e91f06648dd5afb122431b236a1edc
MD5 d91e569fef776387649ce36ec93d8af8
SHA1 b8a87ad4035a6b98723a43b5bec1a66ede98fd1d
SHA512 88f17c594ebed38e4a247915fd337ef637d3187e850c3497fc08d356402ac9e26e4755f9decdb0707568fb2a777faf349b1286c0b3fe3d8824b3915983131468
SSDEEP 6144:EHUw8/64NqBYzeieiL75m/L0Cn4GN6YILOel03CTjgvAmWYaDu0V2yXW:EHj4QByoDb4VlQCwvpWW
TLSH
T159946DBF9A11C091C1EFBAFB9A8B05B5FA76401026533E049076A73E7523F149F71BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db
Size 52KB
SHA256 b840bea98ce7f69b542b4f273260985df9d8bb1c982822f992790b30c11c7661
MD5 7560e396c43099cceb7cc52ad3e8f129
SHA1 5d9581bb5276e38fcf9033f9b0e020881e1dee87
SHA512 9978cd764b0a3b7db8542a5d0c6d489269b6799a91424efec859100cfb40299be6eadbd0bf2cc7d92f76673840db3b637a9e7500ebe0c3d584869313cd7a26d2
SSDEEP 24:TLLSyCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:TPCrQcrA0oJtqracrObMoOS
TLSH
T127339ACF4B862191EFC765B3115392E48E37610E8C9317A62BF760245E83B1AD723C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 512B
SHA256 5b36bd8da523001ba301a69cb6937d55ef12781a471384d2314db9da6cc740f2
MD5 a1972bcf53c1606c8ada41cc0b71ecb5
SHA1 0846162eb5545b980d1468db4bfbb09c3a3dc505
SHA512 20042d27edd5d8b1c11feefdd5607b5d892bf4f2e84f985a915ad3e559e54c37262c269a89e278a0ffbcaab68f898c1002a7c4c43ecfae7a028d756555130c7e
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 64c77fedb6ec7fcd5870c96cf43e64f895096c1b067b8b40d75462dc223bd07d
MD5 bb7089a3f5524ddd239cdbe3e3f04b9f
SHA1 67c1e2f6e4dd42e3bf5315e15aeb69fd9cf92665
SHA512 096bb8f6054323a9275dc9dd025c60f84df368a72894c0ce2fd6420cbc08a7bfa33de6fbe589d5211a8f82a71b1747c4c491309277068be0cc22c4ffe6c1876a
SSDEEP 6:7+/l9vHn10+Wg9bNFlEuWdxEAlOERX4PBX4ogLugMBX4suuKE6:7+tR6qLiuWdxBRmBEyPb6
TLSH
T11B02229EA3C00812C81A56B7D0E683841F10AB28C9B3CF0B095008A46C034CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 3c7b9769e019f40f73cca3aaa6a539b50f8e8d0cc76a0ba0e2a7f0032383d133
MD5 16542bdfc05917947bfa8ddfdd74b978
SHA1 2f39d9c7490da0395f49e549c01c7e7157032bb4
SHA512 326a04f586800a5c1c70e1d5977e7d8cf617dc7ca1311777d4623b69d717bdff5ef54149488b739ec378848da4c65f58e651c73c6fce042fc9b905af981f56b5
SSDEEP 6:7+/l9aluHPg9bNFlLdvtAlOERX4PBX4ogLugMBX4suuK0z2K//Sn:7+tAluvqLJdIRmBEyPb4qSn
TLSH
T18E02C0AAA3C00C03C01D1B77D0C883541F12B724C333CB07055208547C837CCF894D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a42ec552e961eb5c0a2a34704ea60c3e47a9bb2ae04567b55825703766853cc7
MD5 049ee10d1d0171f51cf11dda55af20bd
SHA1 e86ace23b807973d0e65a2841d92416933ad2824
SHA512 3bd5f8dfd0d05b1f128bc5dc80121ffd44e9b6d41c79facdfe0743a601e364eabc2ed0e95ea14415818008467bdb17cfae676090d45baf60a20fc16b6935f294
SSDEEP 48:T0g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSM:FMEX0wIyNjaM
TLSH
T1C143639D5F2C2221C57E283ED7E243635B7C93DF5723927239948CFA8DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5766532fba332ac0b025011407edcb695669c6b773d144443507cf1a3e80bc61
MD5 d06ec1ad9cadac329de260cd15d18bf8
SHA1 c6f9adb096e871e93f0ba7ce84f01c4c7ca3343d
SHA512 a2e0d746a5ccdb7b8300ecf0f76c4a748d5fa53868b6b596b2f3e1e9f5335f64b4411e78b76d296a0ce3bd2b8070266f22ba8b3d9adcf9668cce99984259802b
SSDEEP 6:7+/l9Ocn1sg9bNFlEuWdxEAlOERX4PBX4ogLugMBX4suuKEc:7+tUlqLiuWdxBRmBEyPbRc
TLSH
T14702C09CF7800813CB1D16BB90D483CA1E40E71C99B3CB07055008DC3C034CCE4A1D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0e4535e25047c15de54e653181050f6fe438b1ec7d327b842d7428ebd5a7c2d6
MD5 19dd98dda9d0c88636a3116da39820dd
SHA1 929692730e23119453aabf0d286bd601d078f3d0
SHA512 5c91221c06d0d4fe7886f1706f260882656d61cea9c527c2181cf88750771775f3c19a5638a79f843604cab7467e6ec41f321e5076e7713a9e9b2b21ff8acaf2
SSDEEP 6:7+/l9ps9FPg9bNFlLdvtAlOERX4PBX4ogLugMBX4suuKy/Vkl//asn:7+tY9BqLJdIRmBEyPbDtsXN
TLSH
T18602C088A7400A13C49E177790DC83401F30A7178333CBAB05D008A73C03BCCE890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 92c16bad90b492b5c045c9fb806403c4535db01432bcfdf4ebc894a77492f73e
MD5 0c07f916f8d0491a579be613dd90dc91
SHA1 b4b37e93b0f1fd641fd4c8dbe63c10447552eb9d
SHA512 2ad03580fc571b46bc4030287a0b877847e455506ee2f4b0e915e277c33b11fb74f3a3e8bf6d9e1a2552e9da21e88562cb821c35230ec2109f00626958ac45ce
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 59118f98382dc1f47d88c0d88cbc196ad8db63d0a63cbbc034b8496431b407b2
MD5 232f25b4386d00e63aa49e569ed28a0e
SHA1 cd88cd3eefaebb6ed6e71fd0540808f403f41cf7
SHA512 5549b141a54e02d411683f81ba2a76c25c852515cfe25b519acda0f7545cf548298692b9653d5fe213b5e1c6939275390ea62b76c03a19f6b65541d584e8beed
SSDEEP 6:l9bNFl4/Sls1WlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEW9zmzrfRmBEyPbBvOwk3
TLSH
T1DF72CDCDDF102606C5760737F4C9D3905D64921D4336DA4767950460AD425496451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 4d1c804c1198a61228d003d4b244460304995870ffeaee3fd925aaaba1edebb4
MD5 c48fc956a53743a2cfe977cb2609570b
SHA1 ee400a408fa85e88d648be9c94e965f8aa827fab
SHA512 e93f8b2a7abeb0b997e319150af1f0f5687772ecbb4cc65b0ddc78b8c74ee52dbd5d4d392bc6711312c1232ef4f134b79495bd31e52ad6790e4078d65edca0af
SSDEEP 6:l9bNFlsls19lO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6bps:TLiE99zmzrfRmBEyPbP/P+/0Fl6bXG7
TLSH
T15C7268CCBB106703D1B3473670CF93E11C30A2184737DA0BBB450428AD42189A042F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 9c01ee6ac0792eef63c2dc508630cb0d71dcc842f0453bc6afe5b67a0b85cf80
MD5 6fcacc8ed5d002dd0f9f52133653be6a
SHA1 ecd87131e118ddb36f5af816c35075852e9e66b9
SHA512 5d57b978b6b31888780b00197cf92045aa4ee1828fcf84d30f62611ba8c5538a3aae5db65dba5585d8d8e4afec6e9ef95bad2cae3a405b22634eb7f408559847
SSDEEP 12:TL1EjE9zmzrfRmBEyPbP/hr/gW49blqYFlXW+/0Fl6bXG7:TLbpmzr0GSP/h1499F8lFeW
TLSH
T1437259C9BB209703E2730B3560CBD3D12C3572254B23D607B9021E2C6E427869012F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 43ab8f1ec558c6b8341774197fd83ac7187eb5636e8e97a63baa3b8f1520192f
MD5 71fd56f02cc4cdec6a78124f63ba04e2
SHA1 ef7abdf4beb35b5e06a6c8c3bc872f45ff3bb86b
SHA512 267337d1bf9fc2f26a63ce8a69e98c5165f150ef3f5da0668b9719bec114d44ab58ce673c2857265ea7e7b8c1d1cb44d34373ae8981839b4e07db4377d6e904d
SSDEEP 12:TLIE1h9zmzrfRmBEyPbP/ZRhOLavnOAU7wU7UyWl16a49blqYFlXW+/0Fl6bXG7:TLrpmzr0GSP/nhKamNZ2ma499F8lFeW
TLSH
T19E7276C9BAA4DA02F2B34B3960CFD3D22C3971660723D613BD066B1C2E427929061F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 87c1b75e43b3b69b99f6902305f20e21dc26eae7ea623802bec17e5f95d7ea15
MD5 b890a9e1e2d739920a11c6bd2281d5d9
SHA1 d2b34b3bb4f69ce82a8ccc6109255a1c4dc8217a
SHA512 210795aa50b6cd169b63fa041f665ffa6f8f0f17d5b4b47f443e93b56bb42ebb5d2aebef29e6fbb9b20f02ea77260a8caeb94999839907d2489f10c8e46f7e64
SSDEEP 24:TL6Apmzr0GSP/M9hKamNZ2ma499F8lFeC:T2AArSP/M9camNoC5Iz
TLSH
T1707226C9BAB5DA02F2B34B3961CFD3C22C3971660727DA17B9066F1C2E427969061F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 09ef9aa3754bbbf633f50c22e9d7736cbf1f7216cc8a7ca32cbc7b9008385f90
MD5 d5d0ce485b9414af070e9bc88df5fc1a
SHA1 f5b0251795210750ca59aa7342cc9f0735557a94
SHA512 6efd91dfcc88e3806d099d27f89ce8b04f25213761c9bf51f6b0c347811a9f6f9aa3ce57514eeb56dacf2fa2b1479a7d00aa3cc99d0bad026eedaeff4dd6a8e4
SSDEEP 6:l9bNFlkls1ThlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W8mbl:TL6El9zmzrfRmBEyPbP/W8al
TLSH
T16F72C28DDF102602C6A60676B4CD93615E14A229833BAA572AA90460AD4254AA092F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download