5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725

Analysis

max time kernel
149s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
19/08/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 13.7MB
Sample260819-wh5l2sstd1
SHA256 5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725
MD5 b6b2ded385e7cca688beb3618aa9d643
SHA1 7af30b6113a329f9ab0e6a72e0509624698330c4
SHA512 d2f5457d81fdbbbf252b7a2806d5c290c79039b25352300cd0f0ca4217cce6cfcc8bc5c1cfc087ee7a16d0c8d57208fa43cb7b6bf970f03c3a2fd84677955dc3
SSDEEP 393216:PYB8tMONZWIsH53s7gYB8t8wYB8tDYB8tAoUUMyjeYB8t5/UlZ:ghONZUcddf81MmjtlZ
TLSH
T1ADE6120AEFC87A6BC5F35236487A59294C430D4447C7D983AD99752C18BB6F0BB1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css	4823	com.kisa.octagonpanel
/data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex	4823	com.kisa.octagonpanel

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kisa.octagonpanel

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kisa.octagonpanel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kisa.octagonpanel

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kisa.octagonpanel

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kisa.octagonpanel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kisa.octagonpanel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kisa.octagonpanel

com.kisa.octagonpanel
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
PID:4823

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

iyyL.css

Path /data/data/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 3.6MB
SHA256 4085437981ee6cc56b3d679bf166ae0dda8203a03aa21d9cc8e4d69c0a6be0e2
MD5 460caa88f25d7eb91437a4d58b8c9c39
SHA1 a9d863f7bd79d915ea8359f681b14a1e475d2485
SHA512 546b6489c7b2bf03ef225ea18193d46605b1a529c5147c7c11a12abc4ad2185e9805f6ecc005b5a4b62fb0fcd7c5d173244eb4a08f35ae0415f6c77a063606d0
SSDEEP 98304:AKwt31M66UQs9cCYM8FcG3rYgPkw9fxZ4hj5PfLPUqhtUe:AK831t/CMPgPB9f8PTPNhj
TLSH
T17706337FB2AF1AC3DE9261E9CCB16C65E185977D7017337002E32214568BCA6AC77A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iyyL.css

Path /data/data/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 3.6MB
SHA256 bb7ab0163f5b96ba0a1770077adc5791ddec9040adf7872940e10502bcce1dad
MD5 7bcfbae0b2f0aa737fdf2af111d956b7
SHA1 7f5b6c89c32d1dbc5f981362b8e556fa4ae52abd
SHA512 3cde6b7955de754df2b8ad9acc11873ac742d2ee917f5ee7a8d2d0cc92c89df8a352e0793ed5107727004d406528e6f60d12f76f5211854d5b6e02fe12018333
SSDEEP 98304:iXMvXLre6db9Jd7QwqjfRFqo2r4KB27AvvRO7Y:iXYX2Gxz71qjfRkj4KB27AsY
TLSH
T1490633262C156EB3787C9594F90DEEEEF37B8004C8396E967E1EE4B10406998C0B57ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db
Size 68KB
SHA256 e711dd8148488be44b14b5f7dda71fc01e3f22c4528c83305ff55632034a6fe4
MD5 35ce350d6f8f763dad96802bda0dacdd
SHA1 b2b476f4b299be29902d7652188fcb90ffa7523c
SHA512 5edd108b98852a9e23dfbc1eb4664f3a9b1ad7378173f3397200a99c91e6ecce7dc4fd657f2062c81dce6eb77737ca09a0ed1dde18a73aab97ed4f4b0ebaddc4
SSDEEP 48:TFYCae9KzDQwmjNAEB6DIPC6qrUaLSIxb:Znae43EB6DcdQ
TLSH
T12F63CBC6C728E311C6543030F4520B735E78F62E9AA196D726FC11159CC260ABC7E86E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 512B
SHA256 45f7323f84688c29baac1a32bdc7a46b13633a5cc5772c3fb57f2bbb709a1948
MD5 df6c76ec554755c58aee8fa86bf62444
SHA1 18ae3b3025d2a03e79efd260aa5dfdb4ccb67310
SHA512 94adae16ac8f5fff6b270cae519c3f7e26a2df2aad2b5be8b9ab395e016ad01006217d2c5b4bc140d79294cfd7b37c910181a6340c5837f5f9c353f79748c705
MD5 SHA1 SHA512

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 8069cc0e40f38ef074d1509fc158ae1fc6544daf2357c5f193a8b95c2fffec83
MD5 6a97b374f2eca0197864116db1f8306d
SHA1 5f16af544ad7d39e12c694fda8c85bcf011a1c88
SHA512 8056961a586d8ed44ca24b28f6580a0a65339348b2b89344541684f009f61c3d230d513caf54a09524dad6d130acdf6c5644fd880a9687ba361841454cf7d056
SSDEEP 6:7+/l9hl8Hn11h+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKC:7+tVqh+WqLiuWdYRmBEyPbl
TLSH
T1F802C08C63801813C83F177FA0D483480D24E7388179CB1716904C953C074CCF4A0F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 8KB
SHA256 bc67998ad5ccffd6c39bdf6f46cb581274afa8dd806ef4a7b0e70e1ff6855ba3
MD5 02527453e0b528ebc8b354c42cc037c0
SHA1 277355ef534fa9f00223a6706900f9f53b9d230d
SHA512 03fda3dfd43a8705ef3dcf9641881d0d0d0cf84069512a4895abd03c50ca197e9eee9d099e22c90879030c012d23adeb6758ea2259335f44cb1a3e557af8d6b1
SSDEEP 6:7+/l9+UHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6jEa/2n:7+tUiqLJdeWRmBEyPbLjEq2n
TLSH
T1230222C863400A23C029177BE0CA83802E14AB29D223CB1B96A20C58AC066CCA8A4D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octagon_ward.db-journal

Path /data/data/com.kisa.octagonpanel/databases/octagon_ward.db-journal
Size 12KB
SHA256 1faceb9851b28fd0053dd2e76c9e65a74dce5c9b953601ad72abb18a80fdfd21
MD5 9ee1c281ebb98e246e458d39bd0c1fbb
SHA1 4bc7995e5050d8002d6be694bc66d79222194297
SHA512 594eaff85f167493f29c934f0f9b0a0a194e3a94febd6be3204439d817253b144546a5ac8004789e82cdd7fe4e9053be50327a80f80e73a6e3a8bb6d15231580
SSDEEP 48:7MBoqw1Cae9KzDQwmjNAEB6DIPC6qrUaLSX:7Aohcae43EB6DcdX
TLSH
T1F942EDC5C628E705D3A13430F4510B734D3DB62E9AB1A5D63AFC11199CC290AB07E86F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iyyL.css

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css
Size 8.9MB
SHA256 126f5a7db282cbadd77e391dae0c5be94641bef26a8c935e67d8d2d1cdd25dee
MD5 9e640721020a288dad2d64cf07d8b224
SHA1 5356010a203bffd9168a799d7e1b10bde0793fe2
SHA512 3a220e77864c28e677fbebf13fb9d823ed44520bc1295f231721f23a2982cb071da9c87645ce5ad588d6e3ebc60b08d40e1e6362886f0e21f693d68f20103e14
SSDEEP 98304:2slL/kiUummMqNk91WJT3qeedR6g9M3uhhHnJgRZy:tUHdRB2cfAZy
TLSH
T1D896AF97A602AD33E1AE83363DFF43117B325267776317871480EABC7CC25C65BA9684
MD5 SHA1 SHA512 SSDEEP TLSH

Download

iyyL.css!classes2.dex

Path /data/user/0/com.kisa.octagonpanel/app_shuffle/iyyL.css!classes2.dex
Size 817KB
SHA256 375c3d66b961cce6294887b862379809a79c900eadefb77e5da21ae69de2cb28
MD5 0e49e8e8c061d69ad8c71612b5cab63c
SHA1 ad14768ae279cc94bb793ec9ea763d454c940f4c
SHA512 16664ad6a52aedf9ac6eed34fba250c6528e1e4a32377531df1e11b455cef17334a5e8f3f9413546965fe28e35a5d6e8ccc04a239befc5caf66d17aa004d66ed
SSDEEP 6144:IDVoPuSJD9eMUuZGn92a3jfwcq7jJF4t/xNGPGidXAFpRbmROr9ZQ5otAG3:m+9JDznJF4t/2M2+dL3
TLSH
T1710549A2FB195F31D19E05B60CE713F4133463E76A83A702AE91E568FD82784E35D329
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads