Analysis

  • user interaction
    yes
  • max time kernel
    18s
  • max time network
    32s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    20/10/2026, 17:03

General

  • Target
    PvZ 2 6.5.1 (298).apk
  • Size 13.6MB
  • Sample261020-vknwmsty2l
  • SHA256 c6491f9aa7e830f7a4ed86ebd21a4ac87c8b85698c5be9776020c75747b31161
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.ea.game.pvz2_row
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4314

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Nimble.log

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/Nimble.log
        • Size 755B
        • SHA256 2643864984f12f6242d99aca7d6966f03143d1d5dd1807aed50f1b588c5760bf
        • MD5 SHA1 SHA512 TLSH

        Nimble.log

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/Nimble.log
        • Size 6KB
        • SHA256 8c058828a3ec9c615b8178ab6cce52e677f0ca5737274f82347fd11bbc423a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        [COMPONENT]com.ea.nimble.synergyEnvironment.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.synergyEnvironment.dat
        • Size 4KB
        • SHA256 b469325b30eb01e5cc6e292f050f5d7311686f6a234c1864f9178d50989b81c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        [COMPONENT]com.ea.nimble.synergyidmanager.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.synergyidmanager.dat
        • Size 143B
        • SHA256 4b67ab0827884be39fc8259db88453c790f6e2ea76b0fb1f6d5a7334cea3d532
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.synergyidmanager.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.synergyidmanager.dat
        • Size 185B
        • SHA256 d471567a7b63c9c8c1f4e354e246112f4057f9cbee5611dcb68d64a86aa58eb7
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.s2s.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.s2s.dat
        • Size 1KB
        • SHA256 b13bb77f8e1efb64f181c777fd644d00106df98a94d0af1f69a219b7c844eff5
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.s2s.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.s2s.dat
        • Size 3KB
        • SHA256 07da1bee3e29375b3a005b434f99d9fe8c5e6861f5aadd3ba7c382e0fb6937a6
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.synergy.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.synergy.dat
        • Size 2KB
        • SHA256 6efcd43d7638902cb458ea30505a3704615c0b03573a635acb911f03cf2c1aec
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.synergy.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.synergy.dat
        • Size 1KB
        • SHA256 7c7469df92c86eb43010d23d446651fb1fdd5e1b2df2ab888a864831aa705318
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.synergy.dat

        • Path /data/data/com.ea.game.pvz2_row/cache/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.synergy.dat
        • Size 1KB
        • SHA256 898d47cef004183f5d412b92519096da0a639c937003ec9174839adefa7c9784
        • MD5 SHA1 SHA512 TLSH

        DownloadsDB

        • Path /data/data/com.ea.game.pvz2_row/databases/DownloadsDB
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        DownloadsDB-journal

        • Path /data/data/com.ea.game.pvz2_row/databases/DownloadsDB-journal
        • Size 512B
        • SHA256 354cb8692157aaa3a863e1c4a95bc7c05465d9941fc59568b770b9ae3ae9c93b
        • MD5 SHA1 SHA512

        DownloadsDB-shm

        • Path /data/data/com.ea.game.pvz2_row/databases/DownloadsDB-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        DownloadsDB-wal

        • Path /data/data/com.ea.game.pvz2_row/databases/DownloadsDB-wal
        • Size 40KB
        • SHA256 df25216806533a3f0c5aae3068b70c9ee062993209843a142746629138008f68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6AD79ED300E6-0001-10DA-82C033A06AC5BeginSession.cls_temp

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6AD79ED300E6-0001-10DA-82C033A06AC5BeginSession.cls_temp
        • Size 79B
        • SHA256 fd371e29b2f66ceb522c5d4141f4d0d4bbb3e0653b000dd1d5726ca71526d8d2
        • MD5 SHA1 SHA512 TLSH

        6AD79ED300E6-0001-10DA-82C033A06AC5SessionApp.cls_temp

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6AD79ED300E6-0001-10DA-82C033A06AC5SessionApp.cls_temp
        • Size 116B
        • SHA256 9b404313de7399ec769d8542ceac4bfd8a4d4f70ff0346a8f974f50bf3e29968
        • MD5 SHA1 SHA512 TLSH

        6AD79ED300E6-0001-10DA-82C033A06AC5SessionDevice.cls_temp

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6AD79ED300E6-0001-10DA-82C033A06AC5SessionDevice.cls_temp
        • Size 51B
        • SHA256 c5fb141342b69b2f32fe7cf48b677ffe8650f3c6d9cff0a2e5682180b070a48a
        • MD5 SHA1 SHA512 TLSH

        6AD79ED300E6-0001-10DA-82C033A06AC5SessionOS.cls_temp

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6AD79ED300E6-0001-10DA-82C033A06AC5SessionOS.cls_temp
        • Size 14B
        • SHA256 5fca2279d938d085574c4410592f103674e20245be6bcf4b2637405cea10ec03
        • MD5 SHA1 SHA512

        session_analytics.tap

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 402B
        • SHA256 a901861fb112aaeb538c7558cded8d35b38c7e313b3e03ac73ecddbcd5c3d7d9
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 817B
        • SHA256 7dd72f0cfc00e969d7f7d12e24bbd6d8d94b8a74fdd50129f77b7716097bc96a
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap.tmp

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        sa_f4913f20-5397-4f68-bb8c-0b08a247d2b9_1792515795232.tap

        • Path /data/data/com.ea.game.pvz2_row/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_f4913f20-5397-4f68-bb8c-0b08a247d2b9_1792515795232.tap
        • Size 327B
        • SHA256 85491dbbe2e339d45bce7eb230798ad75a71e18ae6a26c1c2cc45b7faf68d356
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.synergyidmanager.anonymousId.dat

        • Path /data/data/com.ea.game.pvz2_row/files/Nimble/live/persistence/[COMPONENT]com.ea.nimble.synergyidmanager.anonymousId.dat
        • Size 143B
        • SHA256 7810351cabb60625f0e51dd9679ffbc8908fc81ebf5e3ec5a42c684c5dab006f
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.synergyidmanager.anonymousId.dat

        • Path /data/data/com.ea.game.pvz2_row/files/Nimble/live/persistence/[COMPONENT]com.ea.nimble.synergyidmanager.anonymousId.dat
        • Size 187B
        • SHA256 73eb00bf89fc209e3eaac8fa7b4f63f1cdaec5ade73abe5da9e49fd69c97c02c
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.tracking.eventwrangler.dat

        • Path /data/data/com.ea.game.pvz2_row/files/Nimble/live/persistence/[COMPONENT]com.ea.nimble.tracking.eventwrangler.dat
        • Size 156B
        • SHA256 78abad3da68203dedf659a434a52e12c6eeba9a19efb9ef0e72b8379393744c2
        • MD5 SHA1 SHA512 TLSH

        [COMPONENT]com.ea.nimble.trackingimpl.synergy.dat

        • Path /data/data/com.ea.game.pvz2_row/files/Nimble/live/persistence/[COMPONENT]com.ea.nimble.trackingimpl.synergy.dat
        • Size 186B
        • SHA256 890a233ce914cc09e84cf566fe23c715aee6d87bd2f8dfc3b727d2c9ccfa6c0a
        • MD5 SHA1 SHA512 TLSH