80521da70a66581ad9f5f4d8db4f99fa14025b039942dff5f5b4741426048896

Resubmissions

10/07/2026, 07:43

260710-jj73cafv8q7

10/07/2026, 05:36

260710-gap43adx7q7

10/07/2026, 05:33

260710-f8vlrse13t7

10/07/2026, 05:31

260710-f71fmadx5q7

Analysis

user interaction
yes
max time kernel
70s
max time network
73s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/07/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 13.1MB
Sample260710-gap43adx7q
SHA256 80521da70a66581ad9f5f4d8db4f99fa14025b039942dff5f5b4741426048896
MD5 cc451dc1c492252545d4dc1765aebb43
SHA1 1a4d7c8e85d860a35e3f3374c7f583c6cd2fd537
SHA512 2914b725d9a5be723df176a7dc93f141529b9ab56963f92ba9b0899e7b9bb4ddd7f10a72fc0ba7be1d5dd40d9b352da6279a1d08d55509d825c95ffeb3c4ad00
SSDEEP 393216:zYB8tkYB8tfliP8pYb26YB8tNYB8tRx868wRYB8t90:MSEQP8P3VlQmJ
TLSH
T119D6020AEFC8BA2BC5F74235197A5A194C470C444787DD83ED99786C1CB76E0AB1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt	4809	com.kisa.octagonpanel
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt!classes2.dex	4809	com.kisa.octagonpanel
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt	5030	com.kisa.octagonpanel:guard
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt	5097	com.kisa.octagonpanel:sync
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt!classes2.dex	5030	com.kisa.octagonpanel:guard
/data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt!classes2.dex	5097	com.kisa.octagonpanel:sync

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kisa.octagonpanel

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kisa.octagonpanel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kisa.octagonpanel

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kisa.octagonpanel
Framework service call	android.app.IActivityManager.setServiceForeground	com.kisa.octagonpanel:guard

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kisa.octagonpanel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.kisa.octagonpanel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kisa.octagonpanel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kisa.octagonpanel

com.kisa.octagonpanel
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4809

com.kisa.octagonpanel:guard
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
PID:5030

com.kisa.octagonpanel:sync
1⤵
- Loads dropped Dex/Jar
PID:5097

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

OuieS.txt

Path /data/data/com.kisa.octagonpanel/app_shrug/OuieS.txt
Size 3.9MB
SHA256 7bcbc647d062b0bb089a854bbc63b185e1f06a46c5e07b40c6a112dc17c14d5b
MD5 a8a6fb3e59d3cfc8efea2e1c3349429f
SHA1 f00f69f0111e7baede77bb4873a6b20e45dee51d
SHA512 b5065cb6246dd33b29bd74a428780b51c72b2b08ddf14f1a81fc0c464cfe51c4ad495f04aa281471682fcabf59586b3a96dfafa118df4496250e2fabc6e07ef9
SSDEEP 98304:3VSFBWiraVJ820wku8e5rV5on9vY0K1kM22+j3qAa:M3ruv8Nwl4h3O
TLSH
T1D61633FE91F2B54A7097D075FEF05A7B9A3D93E701235A79B40C50CAEC48F491AA4309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OuieS.txt

Path /data/data/com.kisa.octagonpanel/app_shrug/OuieS.txt
Size 3.9MB
SHA256 25472d02e98153dcec1c6ce5b898b4a74768d755ab89f873e98e7029b4f1bc29
MD5 57166b3e9f5e050353beb4b18f731ca1
SHA1 4829c2efd2c9bac6c8c2a3393c3522a40b42fd3f
SHA512 eea7b054e66171a54bd4727bb7d5817cf84dca9113ac997af49d825bf1f9751d1568fe24809d2da3f8f65181bc17ba6bf1fd0a9176af1a41543fc556be39f0d5
SSDEEP 98304:5beER/L1T2ScJDHotmIXy/IQlyFUAOoTqEScuRWC:5h/ES00IHKUABOjb
TLSH
T100163326FEE010EF6CB88CD884D8E7B57A6512EF90514C28695795BE3FDDB980FE9400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db
Size 68KB
SHA256 2d0cdd495f5656b69470f60d9fd0c0fe8044e4fdadd2f4d2ea3dfa4a7f2ed4e4
MD5 bb29559462a0cd3fceb4333e09975fc5
SHA1 c361400293abb468cda8973b497c56bdc17add87
SHA512 3f23514bee1e315a14bfdd7a10869ce332b6284f0c6763570577aef6a09de2df96ca20574631d29506748f7911c7bd1beabaa2a198748a953b2e93a4e3263296
SSDEEP 48:TFYCae9KzDQwmjNAEB6DIPC6qrUaLSkGb:Znae43EB6Dcdk
TLSH
T1FB6398D6C728A315C7683430F4520B735A7CF52E9AA596D636FC11289CC260ABC7E82E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 512B
SHA256 270a0c386271a42b7055911f28b8261f982f7082f9fda5718ab418dcceace536
MD5 6bf285d07a88f5da7a2f90c4cb58daec
SHA1 fe389776ab827223476a2b08c2172e7ecdccf5cd
SHA512 3fce6df973987eb2b4083098099b6b5597de7023a7e2e3ba2bc7393f5b9c68f3d377a79ebf5b1bf3d6c1a0af903dd289a45af37feb455e5b4e7b4248eb433588
MD5 SHA1 SHA512

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 bb15ff01f5819427c78e38d9d1ea46748b5c21002915cef2399d76b5c1b3f9df
MD5 d8a79e5fa65dc2150186dc6981f9584a
SHA1 c360aa08bd30608a4c8332ee064f84402104f5a5
SHA512 2ccb1be1057160f8a8cabdeabab01e27443fae8f0b7ccaf405bb55846dac0673493ef7ce10ac0d1a2d160bc5ca529480240e54fed22c7d298ed626fde96ccb66
SSDEEP 6:7+/l9tNGn1xlpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2F:7+tUqLiuWdYRmBEyPbHF
TLSH
T11D0222CC67800812C82D16B790D483800D64B7288161CBAB17A008982C0B4CCB4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 0779b8045a6a90b8a49a3efb5c6f6fac20ece7aace670a405752ab90f16ef799
MD5 7ddd4965dabb041149f6e930e803e387
SHA1 628f61aff7852e9059ad2d1cb4d3f29cbe0ad0d2
SHA512 0d83c7e1ce2c169cbf559e07b45179a67fabe5d9a8be1c0e8f5977aa0c21b144a1bee28f084e90fff39b2acd1da357d3d729f3592c0886ff0f1e4182f48fa72d
SSDEEP 6:7+/l9DHHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4//w:7+thPqLJdeWRmBEyPbjXw
TLSH
T19E02C08863410C03C13D1777B0CC83601F10A728A373CB175692186A7C076CDECD0E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 12KB
SHA256 b66e73b805c3b03dce2dabe91dae4155337a6083c8823e1e6bd9fde655e59a8a
MD5 c352a64ad3e19409443195197d7827e0
SHA1 753f90e906cdc41484d2b18dae2896cdf57758b1
SHA512 6ae900cfbe03287322d247b262f0b2667c8c84db4bc9e6eb7a040630b187d95f1f06ba2894b0d324b027e7612ea48ac2b4908d7b699b8ae9a5f4cfa147a8b3b5
SSDEEP 48:7M83Eqw1Cae9KzDQwmjNAEB6DIPC6qrUaLS7g:7vEhcae43EB6Dcd7g
TLSH
T15742FEC5C62CE705C3603430F4520B734D3DB62E9AB1A5D63AFC11199CC690AB07E86F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 ace2c19263ac7f38d747f4b0744265893d5eed81d5b15614e73d1733c37e43de
MD5 067b9c6a43fda574c1b76d8be1d98292
SHA1 1ae235bdab4fada6e144d85593efb4718cbcb344
SHA512 55b4db745a073c0cf9800fc194d7571fa022c384d9d7862f88b37da591e131f7c7dc6e56432a1d1ba0f7c297251bb8c9df7cc6895b22a9710522c65ecfdba46a
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb-wal
Size 205KB
SHA256 4a72431db05550470ae631b7507bf4ecdd0b1a944b9b1e3829caaad3ae55f519
MD5 17f139c430ded10af45f8c1e087999a0
SHA1 d4102f40721cc28ec73345268a1e1908339f9390
SHA512 be918f066eed562072f728980582e4d18540f35113e7a95cc8d069c2b8eeb3f96e576116d7a95cb2bafa953bc37716ab0372b8a898d6d918e255d9363cc4982c
SSDEEP 192:5O1DtY8Hm0X4rqXO1DtY/H64GWO1DtY/7O1DtYOXO1DtY5:01DtY91DtY81DtYy1DtYOe1DtY5
TLSH
T1DC2469D25A14830AEE1342FEE8E4B6E057B3AE7F5596490DA8D7FA0434A140726E1F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 80f6c3d4d31389c4fb1534ab4e1dfd6d3c68e165e7a83d1f1b20329fbbd89ed6
MD5 f61cb3bfab04f873165d46ace228ca83
SHA1 6a22515067f758f4ab07a8a9771f999ef1ede80e
SHA512 6b7c2ca4d930e033db9a4c36e59ddc919cd3daf9da8c0d8c8dc45fcde3767b14a3aef6aa5e1360e1f319a84d4a0add9ee82803ba094d78c75e0221b466dc771d
SSDEEP 6:KFiY1uxv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/Vs1nu4Ow2:KFrwPzdeWRmBEyPbP/Vs1nJOw2
TLSH
T1C972C7A893800A22FD5B53F690C9A3100D72B71E6362C70FEA8104216C82B88A1D0E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.kisa.octagonpanel/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 0d0d4bdc0c4a677bb23663128fc632d0e69b5ed8cb80d5bc395d0d675a2b9f44
MD5 b493a5678dcadc71c2980e2bb7b72e16
SHA1 75f801ac33a4e483b607fd2cef758c762e3e9c06
SHA512 b2c7654a52fe1d4df190011b08dd35de62caf54bde2771a9b19b689b3e9594a76e69141a909cddd9d64e3c0a764c7cee72f419d674cdd4f6460e68050683d808
SSDEEP 96:ia3pJEw6+etidjnZRWzzb8/KeKcK+zSDddKz+ZD86u0ExV:13XERtidjnfWzzb83zSDde+ZD86u0ED
TLSH
T1FBC3218D0F592600CC9B54F0E9D01FA1793F522F9793E3D6A5A10075ADD2922EE29CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OuieS.txt

Path /data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt
Size 9.1MB
SHA256 014c25fda7e73b6a17eda917f86d5a40f7f2176f65df619677880b24c2981e90
MD5 1d40e9f6b024246159003ce3ef2f1513
SHA1 1b7aa898e0616cc44064d28d473ce3d4240f0ef7
SHA512 b040e48d95b27fda151c12966d3a3c40ce352e19ff36a38a6965e1aa0e1fc156d7e5cde8eec5b8a37b8d76cff8eb849229f07a7072f0e5f30363ea8edb9c2bfc
SSDEEP 98304:RsvI1BPh5zk2dsrOmMq/UL1WJ13xqNFEbwM18edod1Ijn:RMyBP3zq2I7
TLSH
T1F2A69F53D6536A36C5AE93397EFF43017B32225AB7435BCA1444CAB8BC922C19FF9184
MD5 SHA1 SHA512 SSDEEP TLSH

Download

OuieS.txt!classes2.dex

Path /data/user/0/com.kisa.octagonpanel/app_shrug/OuieS.txt!classes2.dex
Size 1.5MB
SHA256 4dda44775f4a701e8d0350bf695e817dd2b9dcba8853f73669ccdf706298104a
MD5 3793b0b51b2e9f7e1c50d73e5c9e7537
SHA1 5b58f991409532e059dd317ddaebbce6bff5e6e1
SHA512 85852481afbf7028612f1165a810868f5ca54d9133247483d97ce54a320de8d269733363088561502461e8065405f6c221bca5232a6061f41fe97d0c46e550b1
SSDEEP 24576:5VETMcy81WMzNa5t+PQQIEEcw5lxluhtBDyFENBNusotzU5QkgfUFVx:fEpyeWMHTDyFENBNusotzUCktx
TLSH
T118657B17F65D0D32D65E06F20DFA23D4273563EB26839F879E889894FD86381E29C364
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads