2fb0b34cf41328f1826e3d67b17f9e0a65ba5eed500833cc5ec889882c300475

Analysis

max time kernel
125s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/11/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
anbled-2.0.5.apk
Size 3.6MB
Sample261104-wwfvvaeb87
SHA256 2fb0b34cf41328f1826e3d67b17f9e0a65ba5eed500833cc5ec889882c300475
MD5 b09836baee12535db66f3894bc5eee91
SHA1 e43a182e3f6ba865e164f7eb6a5b87a80b23093e
SHA512 86abe39611d1ecb5b2fa6540dadb600f449f22283edc8130d4fefb31e63ada1471b1ae5cced9446f0e41a9d49c34a4a3d8da5e6464a1128b68a0007bd43c709a
SSDEEP 98304:mEQ8priCFpGDtImXRLsnTQ4C9aLrJcaLbJkIDbCPssRgL8:jNktIMunTSir3/JHDbC0sRs8
TLSH
T1E20623A3FB38802FD5AE88798C2F027163329D908516E74B6A8475AC3DB774D1F4A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4759	com.crystalbeats.app
/system_ext/framework/androidx.window.sidecar.jar	4759	com.crystalbeats.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.crystalbeats.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.crystalbeats.app

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.crystalbeats.app

com.crystalbeats.app
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
PID:4759

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.crystalbeats.app/databases/com.google.android.datatransport.events
Size 56KB
SHA256 d575c337197841736e2e4c9afdae0d854644c7056ad8e03fae89242b2711000d
MD5 d15fe47e713d6b84bbbf23baff0cb7e1
SHA1 f1a758119f5200b52f5d5d0261a49cb9e3c4bda0
SHA512 0357bd60aca05eea89d16a70aef89948a1aa9d7bd362c1bed3a559fd8c787a44b4be2326b98f76a85ff39651e7f38709767bbb6b4f84a4f493af56ec29051842
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSY:rAMEX0wIyNjaY
TLSH
T1FD4363AD5B2C2221C57E283ED7E143A35B7C93DF572392623E908CF98DC246974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.crystalbeats.app/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 f510cd5d8baf51acd270e7f8dd0d0d3396e22624413f60d63516efe8ca2c94f5
MD5 c267f8607996c9979f8d5ec0472e33cd
SHA1 c22bcc26288660f87aff420842a16368fd7b3365
SHA512 4260db1e583f52441e09471e43c029431270d883dd7a77cb926765a4abed0b2179c822a79f1fbb89cbbfe89094e13ca15fcc578d0962976bc30a47bde6f06d80
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.crystalbeats.app/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3d1bf04dd4ec45ef319bd4038dbb0fb7fb9ca25b89cf78265e36a1fcd7687f10
MD5 fc267c5f5c8e4595ec3c07dfd8c1c24f
SHA1 d53d60e8bcea82c0511838cbe538192528248f01
SHA512 da959727528252df61a3bf1ec2424838704a9063216dffaf3ac5564c9c525857359c3420c31ff2a36835a30ee96a94967fbe05fa36e85639c86d27fccabc9993
SSDEEP 6:7+/l93On1/Rg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKuP:7+tYqLiuWdYRmBEyPbJP
TLSH
T1AE0222AA63C02C12C82A167B94D483510D00AB288261CB172BD008A82C074CCA4A0F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.crystalbeats.app/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 43603649681f7492e5ba4eb3b2abf7be8736db16be36594df4f56678f09bf395
MD5 5c74f97ea9dcf9ce526b7a4dc3a8394c
SHA1 93d074efad8080311163d15045cae170407b39c9
SHA512 cf3588a3011309c98ad7d91ac0e92c753e38e5e7a542b9269d2d4bd95eacfce5b315d21fa700dba0a12d439fabe552b8b987d9de3a16bfb57d1ae05f8980e81a
SSDEEP 6:7+/l9APg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKwvs//gW:7+tqqLJdeWRmBEyPblvsXgW
TLSH
T19502228863420C03C0296777B4CAC3402E24A73C9223CB0716920C9C2C06ECCA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.crystalbeats.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 2841341edaf7c7986a18c9f7b6a5dc1e097c75cb232d04eaaa0dbaf6532f2cb6
MD5 b33f521ffbaec01b0af39132bff7c898
SHA1 9832487926e51e70f4820451f28e970b50b29359
SHA512 d4bd600786f332fb961287ea5eba83a702e379132d1df4d696970e42550839465eef9e95116d0edd307c27254d3a36cbe77e45f830035f0f91ce4b7bb8ef9fae
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.crystalbeats.app/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.crystalbeats.app/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 434f25eb49e2d07c5c4fc2e22720f726f7075b2b3df08f780c04028b2b9a56e3
MD5 2a2d0f281116150bfda0cb263fcb60c9
SHA1 7abf6fa6a5fadaca4ee9db71824107a1529b5dfe
SHA512 3fbd77495913a930d8b4233a496d8392570ff5a7abc7e59add4a65088b6ab05777a15fe5f10b895200aee8a53fabbe3e85c6ad2534cfbaf828301a76281c9c4f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.crystalbeats.app/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.crystalbeats.app/no_backup/androidx.work.workdb-wal
Size 229KB
SHA256 35f89c3686e5694434e29b9dceed0d718580ce41fabf86a267aab1abc7f31475
MD5 7fa6f36b0852f1d23a41e7d8973f31a2
SHA1 6c2ed3afafcc07522e642803de59b6e26c6d73ad
SHA512 25f82429966b71c97031990dd5747d3f9316e93a1ef99bbf81ca5e09bac214e1bd06ef10c7ed5cad05f69a2547da077768dfef7fc28c2683e759eafcf7442d8e
SSDEEP 384:ZZAFM6ztidjnfWzzb83zSxXD86u0EP1u6/1d1B1+12b:MAfWz03zSxXD86ythPj4Q
TLSH
T19B34648D2F98A910C87B2478F5F007A0BA3E963E5346FBC668D011717D92451B7768BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.crystalbeats.app/primary.prof
Size 11KB
SHA256 c23b6e322d5f6621f149e2b14725ef6e9646e97fa975a7cf4f4fbd036b874b52
MD5 7451d56692d91c2293918df8b7c59755
SHA1 e3891624a803e5d9b3f760097d3b36ce862a7eb5
SHA512 47c77650870400b749414675afdeb121e983e3c89fb780e223e4dd4183fd50cf14bb0ae837625a7354d3495b27c9e5a217c5c125be3f5890cdb63a2b14b4f283
SSDEEP 192:hKpzHyu8A4vvIO9HDKkRag0WI0WCnLqfxMuR045fh8hMZftSi+p2BBLFy3qBwdfs:OqA4XrfHbI3CLgTPdWhGHB+mO5cW8
TLSH
T19042BE1146A04AB2B10D03BDA27E5F23FE5D3B4C0D5893BE5394EB839ED08D1CC1A9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.crystalbeats.app/primary.prof
Size 17KB
SHA256 c55f8f2cf62c2c8d829902ad0ef17d232947080e2bc522343cbff6413ea1dc0a
MD5 d90dd142a3d10a3f3a12366e2c022677
SHA1 6f27e60633d863dbc808e2a2450edcade0f566f2
SHA512 3674f0721ca40f1e2792b979eb67efe7a3abdd31be42f7131d18d3afa9d02c603578fa99b6242be40e7101d1f54a8f56536d09158b926d1c5f2a714ebd83ef41
SSDEEP 384:NGuiSAgHb3aO14qhbhd0KtgWh+yZrsyUbskh5p9qmI0+NU:NNiSAaOG4Ir0qFM4rNUbs8p9qmI0N
TLSH
T1F882C0D330F1C1AAE4F7B14989F47D324F495D15BCFAD382ACCE2DE8565806509A83E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads