753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494

Analysis

max time kernel
46s
max time network
150s
platform
android-15_x64
resource
android-35-x64-arm64-20260721-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.ea.game.pvz2_.apk
Size 4.0MB
Sample260930-lfxtbabf76
SHA256 753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494
MD5 af6f731cd1658877e5bb2c9e985d969a
SHA1 ef342f82fdb71ef841322c543a7a2080fb535bef
SHA512 1b735e97b6ef60083991336f0e1c2d2bf477286910bf7017825a514529b1411e9fd14d2a6510165c66cbd3948f2597a0cdf7dd0239f913101b45b27d0c9ada82
SSDEEP 98304:8JB/IQpnI/VV17GqIgi8Hz2ZmTRBxPQPAZgL4rj7:8V0hGbgi8TFPPL
TLSH
T12D16019AF74CA03FD97B643249BA5225A2974C034DC3AF833944761C29BB5845F6EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ea.game.pvz2_
/system/xbin/su	com.ea.game.pvz2_
/data/local/xbin/su	com.ea.game.pvz2_
/data/local/bin/su	com.ea.game.pvz2_
/system/sd/xbin/su	com.ea.game.pvz2_
/sbin/su	com.ea.game.pvz2_
/system/bin/su	com.ea.game.pvz2_
/system/bin/failsafe/su	com.ea.game.pvz2_
/data/local/su	com.ea.game.pvz2_

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.ea.game.pvz2_

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ea.game.pvz2_

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ea.game.pvz2_

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ea.game.pvz2_

Checks the presence of a debugger
defense_evasion

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ea.game.pvz2_

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ea.game.pvz2_

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ea.game.pvz2_

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ea.game.pvz2_

com.ea.game.pvz2_
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:3283

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3283.tmp

Path /data/data/com.ea.game.pvz2_/cache/oat_primary/x86_64/base.3283.tmp
Size 443KB
SHA256 797b60d507a4d0146a79a8ad4b60ad2a3ca4dc9183c9c1d39548010c652a8247
MD5 28e35ee1ebbcc59f83590f52a1605b03
SHA1 8c92964641c3e71c6e9bfef9bb642cf00b58ec71
SHA512 468d570208b52708de5866fd77c612617efc3779a9444a30d332a6bad47c4f1d1d11a3b729b26573c5d5e17320b9d74092dec0b5670627d88a8bd38fa98c1f1c
SSDEEP 6144:Z0qBY+reSOcwjTdYQ3nvfAxgqnTX1IeJF+Nf00jKlUxecaABbK4HLKpJJmxilie:qYZmctQ/sieiWl6eLWbK42pJwQ
TLSH
T1C1A47DAFDB62C051C1EBAEF79B8B45B9FA29401123561A04A475373EA427F14DB30FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db
Size 52KB
SHA256 373b5463b48928aed647e0887a4586a0ae27775877d089a469559567e59e3045
MD5 4eeec95e196d31adf98136d39dacf9d9
SHA1 669dfd54c8b71b6bd280f9cf271c7508f206844a
SHA512 a2bbbf8f7ec68d4c5678c8d14c69ddbb8c53f6b89d82ccb9a580e8307241bd086f99fa938fd5ab09473bdc746e962c65a544e17e7d53cd7e23173feedc7d573c
SSDEEP 24:TLLS6NCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+x:T7NCrQcrA0oJtqracrObMoOS
TLSH
T1F5337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 512B
SHA256 4f9038dd077ed15064178657df6d2b74aa8ddf0093ffd0f875520af3e6efa2fd
MD5 14f591b17ce3d2dcc2559da1883b9a1c
SHA1 1bb9505d50ac5d67c8cd999b3b694ea642797468
SHA512 72e7eced48218f3c623bf4fbabcfe73b6b226b31a6d2d72c1465178aa78cfd4969a05550403293b26b9f52a97a12c6b22fc4961ecd76e3bb0233aafc7b445589
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 652800aeddb740400de884768505deeb8a296ef887b3fb29d188be5233cc5e96
MD5 d2c84509a34e543d2c47f4e2867dfbc5
SHA1 39e05f992b802f83be898455f69d940a20323f69
SHA512 412d5430d38af15115301ccbaf4ef54a3e37e55409e7d4b1b388c5ff4aaea3197409ab40fc2f523aacfb0c488d1a283b2cb0f11384508e68a868fce6817ece17
SSDEEP 6:7+/l9Nal/gn1M0atng9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuK1:7+taN0aRqLiuWdQoRmBEyPbi
TLSH
T15402228967820816C81956B790E4837C0D20E7589171CB0725500C946C876CCB8A0DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 8KB
SHA256 69c28a2df0f2fe52121ff1b7ecb0028d87dd3d3ba511732cfc600656ee6de9e1
MD5 dd6329962e6405e37342e747a36de026
SHA1 77c679c9164db672b3ae6773f5ea061b1aaf68b5
SHA512 b601d1c0e3d5de3c321ccb796a009dca44975abef230b0b0e3e7c487bd2e5012b90c42fcf67a71321aa4cf42dfd51a5db9ba2991a48ac35a7635bd19548291d7
SSDEEP 6:7+/l9KFPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKnt//d:7+tcBqLJdvloRmBEyPbiV
TLSH
T1FE028099E7820913C61D5B7790D9C3597E30E71983B3CF5B155008587D47BCDEC90D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events
Size 56KB
SHA256 21ae056de970aa5f56e21cc3595d4653e50daccd8a67c26601c514ac6d34d84c
MD5 4f4f24636acbd6734d16eaf63a6bff12
SHA1 4f1f9642d9378b8f17737422ddee87db3280e2b4
SHA512 8b724702055c8a225931da681d740be8293ac6e74e5a420fd3670d7ae6d6b667dbc7dc45ebd1b81bcda4def13a5692320740af463014be96f7369bb2e5cb730c
SSDEEP 48:Tqg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSQ:DMEX0wIyNjaQ
TLSH
T17443639D5A2C2221C57E283ED7E143635B7C93DF572392623E948CFA8DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 de953f00479aa2578e28220fa0811327d45eb0b61b546aef2de840e39ffeeb07
MD5 cdd5ac29706ddbad3b0f15b8d2d206ce
SHA1 ee7927a95b7f1958324c37fc5bb0838cd3b4a856
SHA512 b55c21a65383ddaf5fa620b77d9d168bd152808232af807e8968bfad26ec367b6dc0c1a023d3d9019e0be93205fb61a1bdfd2d743ef67c6d148c59ffd6aff0af
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cdf283cfb2c37739ea9da448a1965e59012f502ae6979a170d25c2ddf80f61d9
MD5 7cdaed4dca19290c151590a9adc7d6ab
SHA1 3a4db13666ad0579f0b7840460d20c2376af7e7e
SHA512 3952db45b0328baa51de247cfb065d08590e8087695e0386b8956f5416037b80d11822cd9732f357185ebfcbeb505fa06ef09b9e491f5606517ca6abab3345f8
SSDEEP 6:7+/l9sgn1Ung9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuK0eJ:7+t6dnqLiuWdQoRmBEyPbG
TLSH
T1FE02228867800812D81A1A7790D4835A0D25AB18A261CF4B15510CD42C874CCA8A2D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b7691a85fb4a4e422474288f7ff8eb2ca4d4402fa8e5916c6fbc14975f03b05a
MD5 7214b5676125af573b5b0fa4c91cf8db
SHA1 5964ba5a0b0cf2fcf4a5217c848ba55942106526
SHA512 5de1c4bd0cf745f4939539bc99654c4bce937d970c9088b554e57c49695e218f46dce2e5d77839cc93347a7c92b3a2994eb263152eafa957d8511601b8f140f0
SSDEEP 6:7+/l9E+/gPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKcM/V:7+th4qLJdvloRmBEyPbpsV
TLSH
T15802C088A7C10A03C41D1F7B90C883681F22A7189373CB07657008783D076CCEC90F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 7434caf4c27640a9ae8f1ea982fb1103c39c91919e5da0a817979e599cf3becb
MD5 7c309c97674cca94d0526aa83ff367a8
SHA1 6c540897730ee919082467fca20e47e96ebbfad3
SHA512 adab5406ae955ed3b2148e04dd01066546639dbd12352b3c496c62d473c498a4ce4f8ffa11f0c5e17b7b1b36791d050ceccfe7ba24467ad8a8ea7a28bf9a0781
SSDEEP 12:TLWuEU9n9zmzrfRmBEyPbBvOwhk/0RT/VM/QC1:TLHppmzr0GSNh/RT/af
TLSH
T10572558DEF20E207E1774736E8CAE3D23D74316A4367C607B9801B5C5E8230558A1F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 0c11c6ccada22e5b48ed1e65b11789e47435475a6b4eb82f16a53f633a279cdf
MD5 c64faa8108143fcfb28f1488a54dd861
SHA1 89d18ce8e3138bacd01936c781fd4875fc9d8678
SHA512 adbc421b1e54b3740bbf87873d1de394a337a997657ee93465d7a153692a9984d1e085d0bcd76612850b7dfd7877c9373a8c9f835a5438dcccb81bb95a51060b
SSDEEP 12:TLiEB9n9zmzrfRmBEyPbP/3p/0RT/VM/QC1:TLXppmzr0GSP/3SRT/af
TLSH
T1607255CDBE209603E273433AA4CAD3D23C30316A4363C9477E501A2C5E8260590A1F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 7f560d5af51cc8652ac5496c41fbbc92a634e4198bae2a368b4c38d24ecc3c7b
MD5 56bb0e76a925e08fdfaba1cbb0266cdb
SHA1 a8ea703a0da065800a05b43b3d136cb55500f4c8
SHA512 03789adf0e2055e80af6f5958b104b5ace4818c23d3a404a3286f13270626337548b0bf09650c8069bfd8b3a11369e55fd6396ae29df8a31a0ccbeedac30f8e7
SSDEEP 12:TL1EuX9n9zmzrfRmBEyPbP/hZt1kn+/0Fl6pG4p/0RT/VM/QC1:TL3Xppmzr0GSP/hZtunlFaSRT/af
TLSH
T19E72598DBB20D707E2774732A4CBD7E32C3431698763C657B9401B5C5E827815151F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 4132dafc71654ab86e6064f0f33ada8ba6b11bffd5bbdcaf5ba678a8cecb2751
MD5 327fd7328bc41c7bcab8c305f7dab4b5
SHA1 e63db402341c6629bdac81eb6c5ca84a34a10703
SHA512 7c4b4632f8fea27e9d83f2c30a753f1c1b701bd2c82682b71fdc65b84d08b276a6dbe65d23afb2901e6bbffc3d8a2cd0c1b56a48404573a184f1ce10c841ecfa
SSDEEP 12:TLIET9n9zmzrfRmBEyPbP/QH49blqYFlXE8n+/0Fl6pG4p/0RT/VM/QC1:TL3ppmzr0GSP/s499Fu8nlFaSRT/af
TLSH
T1C07244DABB24D707F27B4735A0CBE7E23C3831664763C652B9416F1C2E823429261F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 31eff1b8ebb9fff28c0c649ee06a20a9d03f671296db42f25a59e23183976006
MD5 a5808c97f3a05ff029085cfe71284c28
SHA1 e79d4e758fc631c5f42221fb9e078baad2c06a6f
SHA512 1e567c6b4509a560b5e4f2d6ae6081ceee37af0d179b8633bcb80dc064e349829833791d366ddf06fd6ff98346c832e1779224f8631d6d964a040a71affc0f23
SSDEEP 24:TL6+/ppmzr0GSP/oOl5hKamNZ20V+X499Fu8nlFaSRT/af:T2upArSP/o0camNo0V+I5u8naiS
TLSH
T164726699B678DA03F2B74B39A1CBE7D23C3931A61723C653BD426F0C2E423829121F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 050dac198eb477e95b63808635a4557ce2476200b61e2cc04e3de0d1068ab4a1
MD5 4435599983a3140bc7b497f7425c895a
SHA1 0f29a8abceb73d8a0eb4dadcad0c9bfa68dd6805
SHA512 6b9e7685ed1c5f090f8981429fa44734b35f29a0c3382e38d84c7dfb81638748435ea5f926425e9b43fbf6aaf118664b627e8ad57dc43919026e9c455469f853
SSDEEP 6:l9bNFl6ls16o9nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W81:TLAE79n9zmzrfRmBEyPbP/W81
TLSH
T115722BCD9F102603C673073378CD93755C14636D83379E472B950474FD4344A9061F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download