2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742

Resubmissions

01/07/2026, 16:49

260701-vbt2ascs217

01/07/2026, 13:16

01/07/2026, 13:08

01/07/2026, 13:04

01/07/2026, 11:47

01/07/2026, 11:40

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
01/07/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Octagon.apk
Size 14.9MB
Sample260701-ntcreaez31
SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
MD5 bf436336de2ec9d9e404dfb9a4932c84
SHA1 8b544fc2432527930644cc75b69d58bdbe904835
SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
TLSH
T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar	4367	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_squirrel/oat/x86/aaGsx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex	4367	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_squirrel/oat/x86/aaGsx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar	4306	com.jojo.sellfupdater
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex	4306	com.jojo.sellfupdater

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.jojo.sellfupdater

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jojo.sellfupdater

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.jojo.sellfupdater

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jojo.sellfupdater

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jojo.sellfupdater

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jojo.sellfupdater

com.jojo.sellfupdater
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests allowing to install additional applications from unknown sources.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4306
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_squirrel/oat/x86/aaGsx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4367

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aaGsx.jar

Path /data/data/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 3.6MB
SHA256 57227815b0f77219137cfeaa440d5fd613f6a5355a3bca7278b0a2c4f16284fe
MD5 487e837a1f9ef5fc894fce1c2b470266
SHA1 d7a4af8118a7353d2cd0b335142b4c141c815fc4
SHA512 c00874e114a6dd7214aec3fe5ee4c1b0df9d9cfa08084c3aad18f6ebae095f4f7368a3ce086196f10214373efa8c2c162618981d9d704ab6c4db5269121de7fb
SSDEEP 98304:qt+RXvQdUxDuTdMQaSRc4Rqy8F51WPIZ3Jbespa:qkhasIMQFz4X1WAdhet
TLSH
T1530633933B4E8B6042B1B63F2EA055D610CB8F38499D761D92F379A40CD6C1ACF5E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaGsx.jar

Path /data/data/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 3.6MB
SHA256 463ff6034d022878bf3b871207a0081dc8a9ab017e2a74171b781847e154b015
MD5 937ee018079c15a8ec34aea30d6d02ff
SHA1 94c406da13d5e0c7fd173dc1283780e7f429336c
SHA512 765520f5a1f0750f6d93eda71eb0330e0f7da346f13305d94cf80481a9690621597b1ff4a5afdf34b2518a856f3a866ab66805a34baf256160014d664259d3e1
SSDEEP 98304:NFrZo0o5v+FmVvaCkoGDL3rLKg8pcy9U7rslEWX:lfdaaDnLKBpYPsTX
TLSH
T1150633D8E72ED122389F8730742DC58486F927E3A1781D62136F85C9359BF38A3389B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.jojo.sellfupdater/files/profileInstalled
Size 24B
SHA256 fb39872ce07cd82f2fe063079b88b4fe2ba92e49d86fb5c9a3e61295dc53f530
MD5 06ad686cf3bb6671027c8c143d9b1503
SHA1 faa6be21e898b39211fea62a7c473806efd64bd4
SHA512 a661aa90a9039a4ad34efa30da1e34cca4f7387be7c1f260e1aaa2bdf64a9cea3c99a4a32e0063ebdac16ff6c600eb33e3022585977bf4d26dcc068c778fb294
MD5 SHA1 SHA512

Submit Download

aaGsx.jar

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 8.9MB
SHA256 875ee5e803c03f7760e42f7bdcc6159b9ca522df06ea0da57727c9bba5efe6a6
MD5 5d9d6cdf68144cd68e3508929c7bf2b8
SHA1 852ff3cfd2db189ec167846a055499bb9b490b02
SHA512 d41ba8044339fe940e00499e33d42ae4f10ef42f417632602bdef51bdec587e8c1db40ec8f240052ed5bdf1988787ab0d7082f8b319093a7d7ababad142a0602
SSDEEP 98304:Bf1nYcCmKh/q/mMqByr1WJE3BwM4FJosklthmjj:/nYnh2qJoYj
TLSH
T109969D67A606BC33D56E873399EB4741AB3310473F239B8B158495BCBCC36C15BAE258
MD5 SHA1 SHA512 SSDEEP TLSH

Download

aaGsx.jar

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 8.9MB
SHA256 34f3e5d8d9452ebca16bb0ec837ec5f367906b83f4b0a9f0510f35dabde93399
MD5 0ecb4a9f6369e8bc49164263a22a2a91
SHA1 179d9620e506f2c9102506b1008c25170ef67471
SHA512 3b136ccb2ea1558c3b2bb395682bda710174664b063baf698e1519ec273b78605524840313c62515aa3018944d22bd72a4ce65556c3cce908325a17e652f1ea1
SSDEEP 98304:Bf1nYcCmKh/q/mMqByr1WJE3BwM4lijEIN4r0wmhmjj:/nYnh2LEIMj
TLSH
T19C96BF6BA616BC32C5AE833BADFF43007B3211567B6357471184E9BC7DC32C15AAD298
MD5 SHA1 SHA512 SSDEEP TLSH

Download

aaGsx.jar!classes2.dex

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex
Size 849KB
SHA256 ab999548b900e928c961a742d23334305aab9d7ae24ad3e092f75ace063cc6b2
MD5 d0eda4fd8565b694bb9c291b9121bd54
SHA1 c8ad25057c3eb6bb3bbdc53617130a1f3531fd8c
SHA512 ab8d445647c5b2c612093d611612c99c8edf5ec9da236ce9b3de4c6d0de2c23dffb2cb0229f7b05d1e8b5c6f1a0fb832b77733bc30a01f7146f99ca361d8e1a9
SSDEEP 12288:HL/1Z180acFtoY8CTznB2coguYbAppDGAHoXykBbGj:z1Z1ocFuKznBXodf
TLSH
T1910517A3F62C5E32D05A06B30CE762F1133963D35943AB43AE459569FE8B681E71D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

aaGsx.jar!classes2.dex

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex
Size 849KB
SHA256 bddddc355e6af0e007894940dc137c80bed6a4bbb91da0b3b6f7e3177120f1d7
MD5 3a55b0f15295422bc6c23f8a85134115
SHA1 24b8bf9122393b5bfbbd90d963f5492a0815a748
SHA512 5f68cfe7125bea978435c6d9722698d5c695e7a0cc81944cb86bb39972aee5d4dc3f1777384bf26355797823be81945d4614266cc318708b64e377c00452eb06
SSDEEP 12288:HL/1Z180acFtoY8CTznB2coSgQLUXkacj:z1Z1ocFuKznBXoSgtTY
TLSH
T17A0528A3F62C1E31D19A06B70CE722F1133963D75983AB43AE859569FE87281D71D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads