c3d0cb113d37953de040d07525e8ca21e71093fe8e019118f51efd515effeb37

Analysis

max time kernel
67s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/11/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AgendaFlix.apk
Size 1.0MB
Sample261107-pjp5esyscw
SHA256 c3d0cb113d37953de040d07525e8ca21e71093fe8e019118f51efd515effeb37
MD5 1474fa4b118dfe9c03debb972b5fd296
SHA1 ac96a0cc03eefbd8b538cc01ff6ba266cdb1b2e2
SHA512 f10f431e58715ec75680ac73f643cf577ca64c40741381bb1628ac1a9d8ecaddcb8eb98ba47a23ebd19db6e24223fdf28890315a5abdc9be5d1a7f7023dfe525
SSDEEP 24576:vYxj1qA88/jHyrso8LYjlp8P3NBHEXhvgwFEUpgZRpt:vYxjn88/Ghp8FBkXlaUpA
TLSH
T1A035BE52F7D1AD1FCC77C0322B86533661169D1ACA82E70B649437AD2C7BACC0E99BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	br.com.nrodrigues.glowagenda

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	br.com.nrodrigues.glowagenda

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	br.com.nrodrigues.glowagenda

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	br.com.nrodrigues.glowagenda

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	br.com.nrodrigues.glowagenda

br.com.nrodrigues.glowagenda
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4855

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation3037845366626740304tmp

Path /data/data/br.com.nrodrigues.glowagenda/files/PersistedInstallation3037845366626740304tmp
Size 90B
SHA256 47071adbbb6d39906c681f8cd8335df9a2a552af9b5e776062f8c3ee8ec22af3
MD5 2bb6a4a5e39f4d492c9e3fac520e06fd
SHA1 366bfae11d38c46869cc2adb11d412189944a17e
SHA512 f0b3ca44d0e10ba7923c1d7ec2f37fd5f69cdc5b2e6e952a7140578d5e4ce1e67ee3ec3020a689c3e0bd24518f8c510c5fe31113334b561e3b8b0e0016bcdabb
TLSH
T184B012055F3181528B8DA2022C4DE1401F542440058ECA1C0F0AA8E041C13E98193E98
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation774739919632249786tmp

Path /data/data/br.com.nrodrigues.glowagenda/files/PersistedInstallation774739919632249786tmp
Size 566B
SHA256 189055a8534c92e20ec9da5c055afa46c17c03bb1f9b5cb82ec9e14bd14d374f
MD5 1c7b90b509422bed88e1331e5d511b2a
SHA1 9e5e98d17cd54dcc11ea8606361a1957bce1131d
SHA512 09fd6b9127101c8c149bb02298e9ec77d8b245f51878d3f0dfeabc1838bce5485340f6d161256e6a14b000bcb693864c80e3ea2736e5b59ba3403c0ef0fc86ff
TLSH
T10DF0209B0B20DB66CD65160A3B4DBE355E3E1075510A74BE2BCB88E6D584DEE2352E80
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/br.com.nrodrigues.glowagenda/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 602354b3e2f5d199588c30cab9233bd3d5e28459e09ecbf3e627254953f7e65a
MD5 4fd2113c608963c23c37430fc9ee3c90
SHA1 f723ec0fd92c01afc80fbed078cf01648fd351f1
SHA512 714b976b455003faa9f04d3179ba7a9d6c166b991545e2da763091453e341251c2502be3403e1ac17731733f8332be0ead540cbde3b485b43abb2f6bab166a94
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/br.com.nrodrigues.glowagenda/primary.prof
Size 1KB
SHA256 5c8c1621dea241b3aa18e0b5f1f5df39a38e9a76e356f13519abc3c5f354afb4
MD5 e1f80a5004f58d5931866bfaef1ab653
SHA1 2301241d2dccc257e57732b3f3e1506c2ca4e7bc
SHA512 1633667ae252b77e8da6bc7300d8db48d6ae83daa06c4d66b622edba0e849984d009695fe9fa6087b92eedcebc9184811edc4ace2959391a94cf9fa74e06c5f4
TLSH
T18C210803521C5D31310C05146E9523036FDF1770E4EBDE8E019CE7801422EB24ED3BAE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads