ad37ababf6f3e945ec854408cdc0ffb477c7688fff37139affa60b5d635e0409

Resubmissions

01/07/2026, 16:49

260701-vbt2ascs217

01/07/2026, 13:16

01/07/2026, 13:08

01/07/2026, 13:04

01/07/2026, 11:47

01/07/2026, 11:40

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
01/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 8.4MB
Sample260701-vbt2ascs21
SHA256 ad37ababf6f3e945ec854408cdc0ffb477c7688fff37139affa60b5d635e0409
MD5 527357387befd12e768354ff042eebcf
SHA1 e7e1d1b9454cd205837e27f6cfadc71ea193b118
SHA512 2e2ce097a03ed8dd7792aabb8e0a83fa880a4c410bc0a04f8c6a3cebae956750c28583695a4383b2b2369aef080871936727033c5f19c7ed41d1bc57690a11b5
SSDEEP 196608:Dvh1HjESTcrcW+3SvAboQXVCLo7TwB/jXGQx:HLTcrl+3OAboeVlTwVjXGQx
TLSH
T1D396E106EFC4BA3EC9F75236557A5A184C474C448787DD83EE99382C18BB6D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kisa.octagonpanel/app_bargain/FuruR.woff	4765	com.kisa.octagonpanel
/data/user/0/com.kisa.octagonpanel/app_bargain/FuruR.woff!classes2.dex	4765	com.kisa.octagonpanel

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kisa.octagonpanel

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kisa.octagonpanel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kisa.octagonpanel

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kisa.octagonpanel

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kisa.octagonpanel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kisa.octagonpanel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kisa.octagonpanel

com.kisa.octagonpanel
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
PID:4765

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

FuruR.woff

Path /data/data/com.kisa.octagonpanel/app_bargain/FuruR.woff
Size 3.6MB
SHA256 accdae33c58cb92ed4deebeeec81ea36af8aeb4aa8061c17485e5fd601383115
MD5 197f2b4355fa5b0bc584673860ac81f6
SHA1 e1604baf91f0a4c4b3d5664bbe868dd409c1cb85
SHA512 862d76de0c259a5cdd9ed93d0c3f3efad04fe698e1a4d877cdc4308101652447c1755e74f6034761cf3f08537b0987bba2bfeba049f0f2934d2e15c768221364
SSDEEP 98304:j3jmdNoRrTMJb6Nd6OXpFsbFg3NegKIsQ9u5geT:7jmMRMt8cO3s5ONegFP0T
TLSH
T18B06338895FF90032D2968D7EBD26EA533CB7E48DA0FC106A7AC67F944632D90505D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FuruR.woff

Path /data/data/com.kisa.octagonpanel/app_bargain/FuruR.woff
Size 3.6MB
SHA256 ee2d46ea7afa9a83b97d78160408b613ffa174e97ce536d9bf80ed9e29742af5
MD5 c96e37a8a425a0b248713cb415d8d1f4
SHA1 e85428e407f0a8add56a210fbe6571cc96e856ce
SHA512 ee3b147e7ae774421cc1f6075fec2a02c7548501b6544a3be51a9bf276826a4fdd51675304e2c797b82fa4126b3ec59e6ec8de4e521248b149acd8a1c53190d1
SSDEEP 98304:YXMvXLr/oEmhTNCabhOfKnP77vcoPywohQGR:YXYX4EzaFakfts
TLSH
T1F80633C20C2F9629115DDAAA26054E32DA3F058CDF3B5C86717EA371C63DCE494B46EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db
Size 68KB
SHA256 40f929b371c9d65577c7c6be7762172775d9d51d2fa7e7d96775fd20a374c399
MD5 b81745a7ce274f535af9186b54aabbbd
SHA1 d22092f5431040dedfb393bd087881e0100f9483
SHA512 e643c3000215239a33ef9d5c57f0c959de234f98709885163b3776804c22b66f2df4f6edcff475e91f143e0ba58898955fd869de92d78df8bbe52c22ede12204
SSDEEP 24:TLxYCaSEg9K0O3dKGR+GQw7ZgOrQk6FAwAWvO0XxBy1D5RDI/+eoEWP6qpFnUaM2:TFYCae9KzDQwmjNAEB6DIPC6qrUaLSd
TLSH
T14163C9C6C728D315C6583430F4520B735E78F52EAAA097D726FC11249CC360ABC7E86E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 512B
SHA256 6a96ce42cfd56e5fb0fd03ae82ff018d360ff59fb3435a01660dc27861c3529c
MD5 5f9a4f538cced3fbc52289c7ad18fc3d
SHA1 38302e0dd7bad0523657be740639e01711b3c030
SHA512 bf09fae5a18127a2482c2c9e2a89b4a543bd684121d9b1ad603e12e7ca413e6d4d2e3180ef758fd959265b30d16ae605b1eab9feb20f8d45e9c382e0ccef9590
MD5 SHA1 SHA512

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 2588ba08b550230fb3da437b96adf82e850a92c4c4eff03ca01c798c7e5698e2
MD5 f9745f522911e9a102f95221afd63e6e
SHA1 500bb1877cebb0a7bf8aafa936be4f73c1302543
SHA512 440cbb6ed6308afbf946ca3ebcea22a9517ca32993447dcb3382b1f7aa45c5c0a7b07d8dba4fc1d0891e3db12e59a662824bad38a57adbf16e964676eb33b458
SSDEEP 6:7+/l9OHn1EWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+3:7+tEBqLiuWdYRmBEyPbP3
TLSH
T17E02C0FCE3802C23C8AD967F90E583400D00E7389171CB1B16D108943C0F4CCE4A0D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 ae14b6124c1666b281cbf203c89c000d84f05a5326e9fc34d04e0a1be72ea269
MD5 359a89d1ff7d116ef1b5702909a26253
SHA1 2d4d629a622c20ca78c7c90e600d189b8e8e4fa9
SHA512 44b943b8424fb828dacaad079d1908354dbe71862ce5c3b3c0b63e226858b5aa94ac872d6729e485f6e89a2f9b8f75f06308bb5d38447ae854e76ee578736366
SSDEEP 6:7+/l9u0Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK2L//Y:7+t0cqLJdeWRmBEyPbvY
TLSH
T16102C08867400A03C42D1777B4F8C3801E10B7289333CB0736D109B73C076CCE8A2D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 12KB
SHA256 12b33b639dd282c307a10e987c466b1b3ab3b6802ec9c459d5c57e13becb8e60
MD5 8ebe887767a01b23215b74ccfef96524
SHA1 b4e17991ff9688cc23da98f0fa55edf71bad94b6
SHA512 a49f8daa93326779e2bacd4584f0563d7df0815a95292e517ed2f79b1f58c6b479cc47c2843a5d32d7dbde083990003a7aff68923344cb057aad5909ab2a55db
SSDEEP 48:7MsoMqw1Cae9KzDQwmjNAEB6DIPC6qrUaLSn:7KMhcae43EB6Dcdn
TLSH
T16D42FED5C62CE705C3A03470F4510BB34D3DB52E9AB1A5D63AFC11199CC250AB07E86F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FuruR.woff

Path /data/user/0/com.kisa.octagonpanel/app_bargain/FuruR.woff
Size 8.9MB
SHA256 1097f31e111667badb67070850d5420df0558455aab9f48a9f014210018d1f2c
MD5 8dad2225957394a9a90c12eab54bb4d7
SHA1 d78e685916a5d0cd042307cbace2146db4b0ac25
SHA512 f327ff4ef94429e96c9841e5b5b99f53e976cc898d9e1a364ab136a4e3b6430cb558e14f508e7f14ad4233112425a1718c423a51d0df71d0cf2666176fdbf266
SSDEEP 98304:rUMtwkiUMmmMq4o91WJT3qeKV9vUPfmwjTKRm:1yUAV9MPJH
TLSH
T14796AF97A602AD33E1AE83363DFF43107B3252677B6317871484DABC7CC25C65BA9684
MD5 SHA1 SHA512 SSDEEP TLSH

Download

FuruR.woff!classes2.dex

Path /data/user/0/com.kisa.octagonpanel/app_bargain/FuruR.woff!classes2.dex
Size 817KB
SHA256 375c3d66b961cce6294887b862379809a79c900eadefb77e5da21ae69de2cb28
MD5 0e49e8e8c061d69ad8c71612b5cab63c
SHA1 ad14768ae279cc94bb793ec9ea763d454c940f4c
SHA512 16664ad6a52aedf9ac6eed34fba250c6528e1e4a32377531df1e11b455cef17334a5e8f3f9413546965fe28e35a5d6e8ccc04a239befc5caf66d17aa004d66ed
SSDEEP 6144:IDVoPuSJD9eMUuZGn92a3jfwcq7jJF4t/xNGPGidXAFpRbmROr9ZQ5otAG3:m+9JDznJF4t/2M2+dL3
TLSH
T1710549A2FB195F31D19E05B60CE713F4133463E76A83A702AE91E568FD82784E35D329
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads