2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742

Resubmissions

01/07/2026, 13:03

260701-qadkpsgx9t7

01/07/2026, 13:00

260701-p8zp6aex7n7

01/07/2026, 12:53

260701-p437saew7k7

01/07/2026, 12:18

260701-pgr61ady6m7

Analysis

user interaction
yes
max time kernel
85s
max time network
155s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
01/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Octagon.apk
Size 14.9MB
Sample260701-p437saew7k
SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
MD5 bf436336de2ec9d9e404dfb9a4932c84
SHA1 8b544fc2432527930644cc75b69d58bdbe904835
SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
TLSH
T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar	5059	com.jojo.sellfupdater
/data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex	5059	com.jojo.sellfupdater

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.jojo.sellfupdater

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.jojo.sellfupdater

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.jojo.sellfupdater

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jojo.sellfupdater

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jojo.sellfupdater

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jojo.sellfupdater

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jojo.sellfupdater

com.jojo.sellfupdater
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5059

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

aaGsx.jar

Path /data/data/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 3.6MB
SHA256 57227815b0f77219137cfeaa440d5fd613f6a5355a3bca7278b0a2c4f16284fe
MD5 487e837a1f9ef5fc894fce1c2b470266
SHA1 d7a4af8118a7353d2cd0b335142b4c141c815fc4
SHA512 c00874e114a6dd7214aec3fe5ee4c1b0df9d9cfa08084c3aad18f6ebae095f4f7368a3ce086196f10214373efa8c2c162618981d9d704ab6c4db5269121de7fb
SSDEEP 98304:qt+RXvQdUxDuTdMQaSRc4Rqy8F51WPIZ3Jbespa:qkhasIMQFz4X1WAdhet
TLSH
T1530633933B4E8B6042B1B63F2EA055D610CB8F38499D761D92F379A40CD6C1ACF5E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaGsx.jar

Path /data/data/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 3.6MB
SHA256 463ff6034d022878bf3b871207a0081dc8a9ab017e2a74171b781847e154b015
MD5 937ee018079c15a8ec34aea30d6d02ff
SHA1 94c406da13d5e0c7fd173dc1283780e7f429336c
SHA512 765520f5a1f0750f6d93eda71eb0330e0f7da346f13305d94cf80481a9690621597b1ff4a5afdf34b2518a856f3a866ab66805a34baf256160014d664259d3e1
SSDEEP 98304:NFrZo0o5v+FmVvaCkoGDL3rLKg8pcy9U7rslEWX:lfdaaDnLKBpYPsTX
TLSH
T1150633D8E72ED122389F8730742DC58486F927E3A1781D62136F85C9359BF38A3389B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.jojo.sellfupdater/files/profileInstalled
Size 24B
SHA256 75fc49281fe4178477c982518012184c0f7fb2857a925b506816492aa2e01a66
MD5 d544af70b94260bfa803afef40eb8eb0
SHA1 02c82c3d1cbc8cd6d1458527950cfa09887536f6
SHA512 42fb583aa5dbaeb9f79fcfe4276a559eba66e7ffe9d6bbbd42cd85b5e772b87b3a13c7e12f4eecee5a9e4ff83b66cce96d164a1644f7474bdb520d5521c78a7a
MD5 SHA1 SHA512

Submit Download

temp_install.apk

Path /data/data/com.jojo.sellfupdater/files/temp_install.apk
Size 8.4MB
SHA256 ad37ababf6f3e945ec854408cdc0ffb477c7688fff37139affa60b5d635e0409
MD5 527357387befd12e768354ff042eebcf
SHA1 e7e1d1b9454cd205837e27f6cfadc71ea193b118
SHA512 2e2ce097a03ed8dd7792aabb8e0a83fa880a4c410bc0a04f8c6a3cebae956750c28583695a4383b2b2369aef080871936727033c5f19c7ed41d1bc57690a11b5
SSDEEP 196608:Dvh1HjESTcrcW+3SvAboQXVCLo7TwB/jXGQx:HLTcrl+3OAboeVlTwVjXGQx
TLSH
T1D396E106EFC4BA3EC9F75236557A5A184C474C448787DD83EE99382C18BB6D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaGsx.jar

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar
Size 8.9MB
SHA256 34f3e5d8d9452ebca16bb0ec837ec5f367906b83f4b0a9f0510f35dabde93399
MD5 0ecb4a9f6369e8bc49164263a22a2a91
SHA1 179d9620e506f2c9102506b1008c25170ef67471
SHA512 3b136ccb2ea1558c3b2bb395682bda710174664b063baf698e1519ec273b78605524840313c62515aa3018944d22bd72a4ce65556c3cce908325a17e652f1ea1
SSDEEP 98304:Bf1nYcCmKh/q/mMqByr1WJE3BwM4lijEIN4r0wmhmjj:/nYnh2LEIMj
TLSH
T19C96BF6BA616BC32C5AE833BADFF43007B3211567B6357471184E9BC7DC32C15AAD298
MD5 SHA1 SHA512 SSDEEP TLSH

Download

aaGsx.jar!classes2.dex

Path /data/user/0/com.jojo.sellfupdater/app_squirrel/aaGsx.jar!classes2.dex
Size 849KB
SHA256 bddddc355e6af0e007894940dc137c80bed6a4bbb91da0b3b6f7e3177120f1d7
MD5 3a55b0f15295422bc6c23f8a85134115
SHA1 24b8bf9122393b5bfbbd90d963f5492a0815a748
SHA512 5f68cfe7125bea978435c6d9722698d5c695e7a0cc81944cb86bb39972aee5d4dc3f1777384bf26355797823be81945d4614266cc318708b64e377c00452eb06
SSDEEP 12288:HL/1Z180acFtoY8CTznB2coSgQLUXkacj:z1Z1ocFuKznBXoSgtTY
TLSH
T17A0528A3F62C1E31D19A06B70CE722F1133963D75983AB43AE859569FE87281D71D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads