octagon | fc84115cffc90159d463ce3eef79ac637636e3dd5522cfc7260855e80df5f5dc

General

Target
app.apk
Size 20.1MB
Sample260929-jfrk7athrc
SHA256 fc84115cffc90159d463ce3eef79ac637636e3dd5522cfc7260855e80df5f5dc
MD5 ec20838e44accdb16a37c60ca243078e
SHA1 6dbfbe4ef5bf3f7c3ea1ef255c98d2259d9b2610
SHA512 c3ecbbdc8c86ad420555eef3ec6b361a110cf268603e85b01bac2d2b036778f035274b168e1913e10d9b448eb4bd9527fe4e5b1525a053f37a1e921430d553da
SSDEEP 393216:s+B1/zP5gD7P5BMud+vTfhwKf/neR4QTxAjL3GEMrOT3o:D7/eD7PrxdOwK3jumjSJrOo
TLSH
T1A9271206EFC8B979C9F60636587A4A244C438D4447C7D983AA9D746C1C7BAF07B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app.apk
- Size 20.1MB
- SHA256 fc84115cffc90159d463ce3eef79ac637636e3dd5522cfc7260855e80df5f5dc
- MD5 ec20838e44accdb16a37c60ca243078e
- SHA1 6dbfbe4ef5bf3f7c3ea1ef255c98d2259d9b2610
- SHA512 c3ecbbdc8c86ad420555eef3ec6b361a110cf268603e85b01bac2d2b036778f035274b168e1913e10d9b448eb4bd9527fe4e5b1525a053f37a1e921430d553da
- SSDEEP 393216:s+B1/zP5gD7P5BMud+vTfhwKf/neR4QTxAjL3GEMrOT3o:D7/eD7PrxdOwK3jumjSJrOo
- TLSH
  T1A9271206EFC8B979C9F60636587A4A244C438D4447C7D983AA9D746C1C7BAF07B1EBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  payload.base
- Size 7.3MB
- SHA256 8e7740d7fb670202cd101a29adb3103eceefab00c574a387230f467f5741534f
- MD5 3e07dc58d593b95ebcf429c399a063d2
- SHA1 db0883b645ed5aa53392a09e5a9ef151288a4f08
- SHA512 4c78fd42135269a7ff337918abf21d41631bcc8ddf4dd2484e370ce1b4129865584d3fc43f728ef9cdba5a298fcc57e0054e7e745d1acfa665373af6cb469cb1
- SSDEEP 98304:MLYLra4+bHRGT3SiJmj3uDO3J/F+WA3jZbQZlic15A5AQAcAdANO1Tt0rx10As:H+bHRGT3S6mjDJwRtbQn31++hNynY
- TLSH
  T1C476F09AEBC8AA6BD0F7633241365221514B4C268F87D7C39D45363C28BB5D40F9EBC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion octagon impact infostealer persistence rat trojan
- Family: Octagon
  Octagon is an Android RAT first seen in 2026.
  rat trojan infostealer octagon
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of SMS inbox messages.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
behavioral2