5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725

Analysis

user interaction
yes
max time kernel
60s
max time network
61s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
19/08/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 13.7MB
Sample260819-wh5l2sstd1
SHA256 5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725
MD5 b6b2ded385e7cca688beb3618aa9d643
SHA1 7af30b6113a329f9ab0e6a72e0509624698330c4
SHA512 d2f5457d81fdbbbf252b7a2806d5c290c79039b25352300cd0f0ca4217cce6cfcc8bc5c1cfc087ee7a16d0c8d57208fa43cb7b6bf970f03c3a2fd84677955dc3
SSDEEP 393216:PYB8tMONZWIsH53s7gYB8t8wYB8tDYB8tAoUUMyjeYB8t5/UlZ:ghONZUcddf81MmjtlZ
TLSH
T1ADE6120AEFC87A6BC5F35236487A59294C430D4447C7D983AD99752C18BB6F0BB1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css	4256	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kisa.octagonpanel/app_shuffle/oat/x86/iyyL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex	4256	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kisa.octagonpanel/app_shuffle/oat/x86/iyyL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css	4230	com.kisa.octagonpanel
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex	4230	com.kisa.octagonpanel

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kisa.octagonpanel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kisa.octagonpanel

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kisa.octagonpanel

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kisa.octagonpanel

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kisa.octagonpanel

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.kisa.octagonpanel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kisa.octagonpanel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kisa.octagonpanel

com.kisa.octagonpanel
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4230
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kisa.octagonpanel/app_shuffle/oat/x86/iyyL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4256

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

iyyL.css

Path /data/data/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 3.6MB
SHA256 4085437981ee6cc56b3d679bf166ae0dda8203a03aa21d9cc8e4d69c0a6be0e2
MD5 460caa88f25d7eb91437a4d58b8c9c39
SHA1 a9d863f7bd79d915ea8359f681b14a1e475d2485
SHA512 546b6489c7b2bf03ef225ea18193d46605b1a529c5147c7c11a12abc4ad2185e9805f6ecc005b5a4b62fb0fcd7c5d173244eb4a08f35ae0415f6c77a063606d0
SSDEEP 98304:AKwt31M66UQs9cCYM8FcG3rYgPkw9fxZ4hj5PfLPUqhtUe:AK831t/CMPgPB9f8PTPNhj
TLSH
T17706337FB2AF1AC3DE9261E9CCB16C65E185977D7017337002E32214568BCA6AC77A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iyyL.css

Path /data/data/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 3.6MB
SHA256 bb7ab0163f5b96ba0a1770077adc5791ddec9040adf7872940e10502bcce1dad
MD5 7bcfbae0b2f0aa737fdf2af111d956b7
SHA1 7f5b6c89c32d1dbc5f981362b8e556fa4ae52abd
SHA512 3cde6b7955de754df2b8ad9acc11873ac742d2ee917f5ee7a8d2d0cc92c89df8a352e0793ed5107727004d406528e6f60d12f76f5211854d5b6e02fe12018333
SSDEEP 98304:iXMvXLre6db9Jd7QwqjfRFqo2r4KB27AvvRO7Y:iXYX2Gxz71qjfRkj4KB27AsY
TLSH
T1490633262C156EB3787C9594F90DEEEEF37B8004C8396E967E1EE4B10406998C0B57ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 512B
SHA256 dba8d3686987e792249d567698e1dc13ffce3e8462bd6db1db9019aaefd39137
MD5 e18e38f5d7dad63114c3cb52f551a09c
SHA1 e11f47de61ea2b86ddda348642718dd64179a00a
SHA512 0c925de0478e53fbc02b38a103469b5b8f11280faebba525236f4f3c3df6646810cc470cc7e2449ab489af34eb4682b996b46450b49281141b925bb87ef230ba
MD5 SHA1 SHA512

Submit Download

octagon_ward.db-shm

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

octagon_ward.db-wal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-wal
Size 88KB
SHA256 2398469db5e129bdadbb4bd8bb50a0016ef8ba70ca6c1c242dec4f1aecb88f58
MD5 efd0e9b972add8c660a1a6a75797eb63
SHA1 d0791cb5ed1f353f978cafffc909f032920c68b7
SHA512 74035eef6b70f7cbf06b01f7d8ee3f4542b1a0461c0079ed7870eb2d75732b1ec8d91e911d970c72f42d980bf9e08eefb482ce79513f9f9d416b3ffa428f059d
SSDEEP 48:HzNSP/RrtaCae9KzDQwmjNAEB6DIPC6qrUaLSP/SiwS4:T0Pz1ae43EB6DcdP6iwX
TLSH
T1CC931F81C318DB51C2062031F4C307633A7AF11ED7ABD7C326BC19385CE265AA87989E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.kisa.octagonpanel/files/profileInstalled
Size 24B
SHA256 0eb60fe8b236375df6d7b4239b12a46b9a5713ac6ab3601f6f73c7b46434a828
MD5 2ba1bb23eb17568502ee38df7cc5eae9
SHA1 690871c109d8e35116952026103f30099669604b
SHA512 b39047d5023a291e9ae5bae1b215a398c8abe22a52e65315dba0e4c5e51d24d79da580d76681a92e972d91ed1a979a379f37ab604442dbde966c60bfc68b8804
MD5 SHA1 SHA512

Submit Download

iyyL.css

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 8.9MB
SHA256 469b655336491f1ddc6213813c99bbf913bf87d65789d979c908d71933edaa2c
MD5 3efa2683b2fa851b9eadf1dd06c20f59
SHA1 44c65c36d1da2d481f22e3e250e36a0bfaafc01a
SHA512 76880cf1e76cd8652ff8df88b052ece6905eec6add536d2d32dfd914fd75ab2f23f04ce9fd6242ca1e3c3d25e1f02d99f5cb303cfe903b2d2874fee9b9977202
SSDEEP 98304:2slL/kiUummMqNk91WJT3qeeI6XbaiYVpZy:tUHI6Xb6/Zy
TLSH
T1CF969E86A602B933E06E4B336DFF0355AB3352573F235B4718409ABCBCC65C61BB9658
MD5 SHA1 SHA512 SSDEEP TLSH

Download

iyyL.css

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 8.9MB
SHA256 126f5a7db282cbadd77e391dae0c5be94641bef26a8c935e67d8d2d1cdd25dee
MD5 9e640721020a288dad2d64cf07d8b224
SHA1 5356010a203bffd9168a799d7e1b10bde0793fe2
SHA512 3a220e77864c28e677fbebf13fb9d823ed44520bc1295f231721f23a2982cb071da9c87645ce5ad588d6e3ebc60b08d40e1e6362886f0e21f693d68f20103e14
SSDEEP 98304:2slL/kiUummMqNk91WJT3qeedR6g9M3uhhHnJgRZy:tUHdRB2cfAZy
TLSH
T1D896AF97A602AD33E1AE83363DFF43117B325267776317871480EABC7CC25C65BA9684
MD5 SHA1 SHA512 SSDEEP TLSH

Download

iyyL.css!classes2.dex

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex
Size 817KB
SHA256 a0e5b9b08e57208f21a876e1393dec25b896ce08d387a7f11e6b7203c22a2963
MD5 38e1e27edbd059d9738be630dc25aaed
SHA1 2314f4068f8a1b7fcc12d8d48d8d18c1e05a2ebc
SHA512 e42da083bbfc58550139f8ecc5e949e743c7638aa74b10314fb1ae4be644405d786a6bdb17b632852d6a6c15ccaef027cbebae33c13de42a62b7a9780138ba34
SSDEEP 12288:m+9JDznJF4t/2zX2w3k8YPeBaDF+SjIfFeg3:z/R2t2Zl
TLSH
T16C0539A1F7195E32D19E06B74CE713F0133063E76A83E702AE81A578FD86684E75D329
MD5 SHA1 SHA512 SSDEEP TLSH

Download

iyyL.css!classes2.dex

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex
Size 817KB
SHA256 375c3d66b961cce6294887b862379809a79c900eadefb77e5da21ae69de2cb28
MD5 0e49e8e8c061d69ad8c71612b5cab63c
SHA1 ad14768ae279cc94bb793ec9ea763d454c940f4c
SHA512 16664ad6a52aedf9ac6eed34fba250c6528e1e4a32377531df1e11b455cef17334a5e8f3f9413546965fe28e35a5d6e8ccc04a239befc5caf66d17aa004d66ed
SSDEEP 6144:IDVoPuSJD9eMUuZGn92a3jfwcq7jJF4t/xNGPGidXAFpRbmROr9ZQ5otAG3:m+9JDznJF4t/2M2+dL3
TLSH
T1710549A2FB195F31D19E05B60CE713F4133463E76A83A702AE91E568FD82784E35D329
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads