Octagon[.]apk | Triage™

Target
Octagon.apk
Size 14.9MB
Sample260701-vbt2ascs21
SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
MD5 bf436336de2ec9d9e404dfb9a4932c84
SHA1 8b544fc2432527930644cc75b69d58bdbe904835
SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
TLSH
T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Octagon.apk
unpack001/payload.base

File Explorer

Octagon.apk

.apk 14.9MB
payload.base

.apk 8.4MB

Octagon.apk

SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
MD5 bf436336de2ec9d9e404dfb9a4932c84
SHA1 8b544fc2432527930644cc75b69d58bdbe904835
SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
TLSH
T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a15a4bd21452ac7d675fc9946570a993a316fdabac4a9c9dd78027b7de6076bb

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国

com.jojo.sellfupdater

payload.base

SHA256 ad37ababf6f3e945ec854408cdc0ffb477c7688fff37139affa60b5d635e0409
MD5 527357387befd12e768354ff042eebcf
SHA1 e7e1d1b9454cd205837e27f6cfadc71ea193b118
SHA512 2e2ce097a03ed8dd7792aabb8e0a83fa880a4c410bc0a04f8c6a3cebae956750c28583695a4383b2b2369aef080871936727033c5f19c7ed41d1bc57690a11b5
SSDEEP 196608:Dvh1HjESTcrcW+3SvAboQXVCLo7TwB/jXGQx:HLTcrl+3OAboeVlTwVjXGQx
TLSH
T1D396E106EFC4BA3EC9F75236557A5A184C474C448787DD83EE99382C18BB6D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

2b97b7239f342bf68d1e9ba26ed59d72874d0b4f19d215b82c4aa319a1e81607

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国

com.kisa.octagonpanel

Android Permissions

Octagon.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.INTERNET

android.permission.POST_NOTIFICATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

com.jojo.sellfupdater.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Octagon.apk

File Signature issue

com.jojo.sellfupdater.MainActivity

com.jojo.sellfupdater.PermissionObserverService

com.jojo.sellfupdater.InstallationReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

payload.base

File Signature issue

com.kisa.octagonpanel.MainActivity

com.kisa.octagonpanel.onboarding.OnboardingActivity

com.kisa.octagonpanel.ConnectionSettingsActivity

com.kisa.octagonpanel.overlay.GateOverlayActivity

com.kisa.octagonpanel.accessibility.WardAccessibilityService

com.kisa.octagonpanel.service.WardForegroundService

com.kisa.octagonpanel.receiver.SmsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider