Analysis
- max time kernel
77s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
07/11/2026, 12:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
AgendaFlix.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
AgendaFlix.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
AgendaFlix.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target AgendaFlix.apk
- Size 1.0MB
- Sample261107-pjp5esyscw
- SHA256 c3d0cb113d37953de040d07525e8ca21e71093fe8e019118f51efd515effeb37
- MD5 1474fa4b118dfe9c03debb972b5fd296
- SHA1 ac96a0cc03eefbd8b538cc01ff6ba266cdb1b2e2
- SHA512 f10f431e58715ec75680ac73f643cf577ca64c40741381bb1628ac1a9d8ecaddcb8eb98ba47a23ebd19db6e24223fdf28890315a5abdc9be5d1a7f7023dfe525
- SSDEEP 24576:vYxj1qA88/jHyrso8LYjlp8P3NBHEXhvgwFEUpgZRpt:vYxjn88/Ghp8FBkXlaUpA
- TLSH T1A035BE52F7D1AD1FCC77C0322B86533661169D1ACA82E70B649437AD2C7BACC0E99BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener br.com.nrodrigues.glowagenda - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock br.com.nrodrigues.glowagenda - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo br.com.nrodrigues.glowagenda - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone br.com.nrodrigues.glowagenda - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver br.com.nrodrigues.glowagenda - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo br.com.nrodrigues.glowagenda - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo br.com.nrodrigues.glowagenda
Processes
-
br.com.nrodrigues.glowagenda1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5106
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/br.com.nrodrigues.glowagenda/files/PersistedInstallation2284169445174780110tmp
- Size 567B
- SHA256 b73090d1d71e0fa446278b8057839fa73d753febcca79d8c66043cbbcaab1358
- MD5 68c14afe0bc7f261ec758659857621c4
- SHA1 26297a6482440f802b0f5f49f04e8982eb9c7673
- SHA512 6c0b5612f7be25224207ad8c41e61a7940b7c4076914d5264fd2d963c04614de781d1d17dba7c9ae25c3d7bc5decb9dba1509a968758f97db46739988755fc54
- TLSH T10EF0419601A0DFA9D8049A031E887C001D2C04A041269C355EEE40E0D3A1EE8511B808
- MD5 SHA1 SHA512 TLSH
- Path /data/data/br.com.nrodrigues.glowagenda/files/PersistedInstallation2395957612750294433tmp
- Size 90B
- SHA256 f0db30f1f173da98525196d0af4dfb155783e97c72324ba30ed4249b91eba5c5
- MD5 d3c3c558358cd5f1c8957cad4b4ea4c4
- SHA1 fb9a1f4b785a430666544877b379c1a9dcfa44e9
- SHA512 562ed5334309522349cacef1401260f19ad599e8e012f8c3fb3024412ed02e561f66d87c8c7b79cf824b6829988c06dbfae19afc6c17220a8076c2188ad94c30
- TLSH T193B0124186B18381CD89F2021F4CE1002E5355480549CB090B09D04042852D19113ED4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/br.com.nrodrigues.glowagenda/files/profileInstalled
- Size 24B
- SHA256 98f34eed73ad789b8d7af4d7c3b19dbffd0a8e6f9821fab5fbe5bbf81ef8af04
- MD5 c7d44f47ec41c05609777cb6cb327ced
- SHA1 694812f00705359cbf792e18dbbb6d1c57424230
- SHA512 0ce8aa8e96d472704402fab22eab3b24c913be4a3697c1e56f0151adb0bdb079d28938e8a219c173cebb7fa64c1b264dc8c47ab73ea8021169d6d5a7fa01979b
- MD5 SHA1 SHA512
- Path /data/data/br.com.nrodrigues.glowagenda/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 f420469ab076977c0f20bb2a94cd26a0a018b7c653d5ac4dcf914ba79c05a6b7
- MD5 e4a3d7b698143a8473fb1c33490244eb
- SHA1 32e9c8e1b6a55bd9f16e97cf7662da3ba1e775a2
- SHA512 4ee4a072ec19f5de596b73110c8059b5ea3915f5b65c9522afb8c2c3d84820e07ccb8a100f6d21e6f405f32e7f72fe7fef9ee1c6f4d15e7e08c85eaaf6216b45
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/br.com.nrodrigues.glowagenda/primary.prof
- Size 1KB
- SHA256 e81925abb073e2d8e52fa9e8c63f261686e12efba3ae8948f8f6839789278393
- MD5 151ac53bb5acbde1789624e99e2ef651
- SHA1 2321b7edeb9a0ae482e8bee7d2531742a8da367d
- SHA512 8e5858402791a2e1481ff8be017c427dfe2e99fa3e86482daab21ce3c7c097e810556cf17379f9763ffda5b07c6dfca3e7ef1577c3c5cc51e2d67ec8196f9adf
- TLSH T1E4412E03D761EA55781731EC22E895955D0B43709F9B870D26CFF2142057E1C57CD2E7
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/br.com.nrodrigues.glowagenda/primary.prof
- Size 1KB
- SHA256 5c8c1621dea241b3aa18e0b5f1f5df39a38e9a76e356f13519abc3c5f354afb4
- MD5 e1f80a5004f58d5931866bfaef1ab653
- SHA1 2301241d2dccc257e57732b3f3e1506c2ca4e7bc
- SHA512 1633667ae252b77e8da6bc7300d8db48d6ae83daa06c4d66b622edba0e849984d009695fe9fa6087b92eedcebc9184811edc4ace2959391a94cf9fa74e06c5f4
- TLSH T18C210803521C5D31310C05146E9523036FDF1770E4EBDE8E019CE7801422EB24ED3BAE
- MD5 SHA1 SHA512 TLSH