Octagon Android Banking Bot (MaaS): AndroidKitKat's Crypto-Stealing Trojan — OTX Pulse Analysis & Detection Pack

Threat Summary

OTX pulse data published by AlienVault on 2026-08-18 confirms the emergence of Octagon, a previously undocumented Android fraud bot first identified in June 2026. Octagon is operated as a malware-as-a-service (MaaS) offering by the Russian-speaking threat actor AndroidKitKat, who rents the bot for $1,400 per month — placing advanced mobile banking fraud capability within reach of low-skill criminal affiliates.

Octagon is purpose-built for financial theft. Its attack chain follows the now-standard modern Android banker playbook:

1. Delivery — Social engineering lures (fake banking apps, wallet update prompts, SMS phishing / smishing) trick victims into sideloading a malicious APK.
2. Permission escalation — The malware abuses Android Accessibility Services to grant itself elevated privileges without further user interaction.
3. Credential & session theft — Overlay attacks render convincing phishing screens on top of legitimate banking and crypto-wallet applications; unlock patterns are captured; incoming SMS messages (including MFA/OTP codes) are intercepted.
4. Remote takeover — A hidden VNC (HVNC) module gives operators live remote control of the infected device, enabling direct fraudulent transactions, balance reading, and session hijacking that bypasses device-fingerprinting controls.

The objective is unambiguous: monetization through direct financial fraud — draining bank accounts and cryptocurrency wallets while harvesting credentials for resale on criminal marketplaces. The MaaS pricing model means this threat will scale: expect multiple affiliate operators, distinct distribution clusters, and rapidly mutating samples.

Threat Actor / Malware Profile

Actor: AndroidKitKat (Russian-speaking, financially motivated, MaaS operator) Malware: Octagon (Android banking trojan / fraud bot) Price point: $1,400/month subscription Targeted sector: Finance — banking applications, cryptocurrency wallets, exchanges

Distribution

• Sideloaded APKs delivered via smishing links, malicious landing pages, and trojanized "banking" or "wallet update" applications
• Distribution infrastructure observed on cheap/bulletproof hosting (see IOC section — the 209.99.x.x netblock indicators are consistent with parked/redirect infrastructure repurposed for lure delivery)

Payload Behavior

• Accessibility Services abuse — Self-granting permissions, auto-clicking through consent dialogs, reading on-screen content from any app (balance reading, credential capture)
• Overlay injection — Draws pixel-perfect fake login screens over targeted banking/wallet apps (T1024/T1656-style impersonation on mobile)
• Hidden VNC (HVNC) — Establishes an invisible remote session for hands-on-keyboard fraud; invisible to the device user
• SMS interception — Captures inbound OTP/MFA codes and can suppress notifications
• Unlock-pattern capture — Records device lock-screen patterns for offline access

C2 Communication

• Outbound connections to operator-controlled infrastructure over HTTP(S) for command polling, target-app list updates, and exfiltration of captured credentials/SMS
• HVNC channel typically rides a separate persistent TCP session to the same or adjacent infrastructure

Persistence & Anti-Analysis

• Accessibility Service persistence (survives reboots once granted)
• Icon hiding / masquerading as legitimate system or financial apps
• Emulator and sandbox checks common to modern Android bankers; frequent re-packing per affiliate (explains the multiple distinct MD5 sample hashes in the pulse)

IOC Analysis

The pulse contains 17 indicators across two types:

Operationalization guidance for SOC teams

• IP indicators: Push to firewall, proxy, DNS-sinkhole, and EDR network-block lists immediately. Alert on any egress — corporate devices should never communicate with these hosts. Netflow retrospective analysis for the past 90 days is recommended.
• MD5 hashes: These represent Android APKs — they will primarily match in mobile threat defense (MTD/MTM) tooling, email/web gateways (if APKs transited corporate channels), and file-upload events to cloud storage. Load into your TIP and match against MDM app inventories and any APK observed on network shares or download proxies.
• Tooling: AbuseIPDB/VirusTotal for IP reputation enrichment; OTX DirectConnect / TAXII feed for automated sync; MalwareBazaar/hash-reversing for sample triage; MobSF or jadx for static APK analysis if a sample is recovered.

Detection Engineering

---
title: Network Connection to Octagon Android Bot C2 Infrastructure
id: 9f3a2b71-oct4-4b6e-8a1c-octagon2026a
status: experimental
description: Detects egress connections to known Octagon Android banking trojan C2 / delivery infrastructure reported in OTX pulse (AndroidKitKat MaaS). Any connection from a corporate asset warrants immediate investigation.
author: Security Arsenal Threat Intelligence
references:
  - https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps
date: 2026/08/19
logsource:
  category: network_connection
product: zeek
detection:
  selection_dst:
    id.resp_h:
      - '45.192.12.34'
      - '209.99.184.50'
      - '209.99.187.28'
  condition: selection_dst
falsepositives:
  - Threat intelligence infrastructure scanning
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
---
title: Outbound Connection to Octagon C2 - Windows Firewall/Proxy
id: 9f3a2b71-oct4-4b6e-8a1c-octagon2026b
status: experimental
description: Detects proxy or firewall egress to Octagon Android bot C2 IP addresses. Covers scenarios where managed Android devices traverse corporate Wi-Fi or where droppers are staged via workstation browsers.
author: Security Arsenal Threat Intelligence
references:
  - https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps
date: 2026/08/19
logsource:
  category: proxy
detection:
  selection_ip:
    c-ip:
      - '45.192.12.34'
      - '209.99.184.50'
      - '209.99.187.28'
  selection_domain:
    cs-host|contains:
      - '45.192.12.34'
      - '209.99.184.50'
      - '209.99.187.28'
  condition: 1 of selection_*
falsepositives:
  - Rare; IP-based hosting with no legitimate corporate use expected
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
---
title: VNC Server Execution on Non-Server Endpoint (Octagon HVNC TTP Analog)
id: 9f3a2b71-oct4-4b6e-8a1c-octagon2026c
status: experimental
description: Detects execution of VNC-related binaries on endpoints. Octagon's hidden VNC capability mirrors this technique on mobile; on workstations, unexpected VNC execution indicates remote-access-trojan or fraud-tool staging by the same actor ecosystem.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vncserver.exe'
      - '\winvnc.exe'
      - '\tvnserver.exe'
      - '\vncviewer.exe'
      - '\hvnc.exe'
  selection_cmd:
    CommandLine|contains:
      - 'vnc'
      - 'hvnc'
  condition: selection_img or selection_cmd
falsepositives:
  - Legitimate IT remote administration tooling - whitelist approved VNC deployments by path and signer
level: medium
tags:
  - attack.command_and_control
  - attack.t1219

// Octagon Android Bot - C2 & Dropper Hunt (Microsoft Sentinel / Defender XDR)
// Hunts network connections to Octagon C2 infrastructure and file drops matching known sample hashes
let OctagonIPs = dynamic(["45.192.12.34", "209.99.184.50", "209.99.187.28"]);
let OctagonHashes = dynamic([
    "3530b1600e059468e585d48482bb2f37",
    "41d922a220ac28a4af8cbed3ffff517b",
    "471bcf065c6ed44282c5776ee78bc6d0",
    "b7e9072e5bda17e0c68db01010658481",
    "d472e984c6e8f3d4d7352125ebcc7c3c"
]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (OctagonIPs)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend IndicatorType = "C2_IP";
let FileHits = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where MD5 in (OctagonHashes) or FileName endswith ".apk"
    | project TimeGenerated, DeviceName, FileName, FolderPath, MD5, SHA256
    | extend IndicatorType = "APK_Drop";
union NetworkHits, FileHits
| sort by TimeGenerated desc

# Octagon Android Bot - IOC Hunt Script
# Checks for connections to Octagon C2 IPs and known APK sample hashes on Windows endpoints
# (covers APKs staged via workstation, corporate Wi-Fi egress, or email downloads)

$OctagonIPs = @("45.192.12.34", "209.99.184.50", "209.99.187.28")
$OctagonHashes = @(
    "3530b1600e059468e585d48482bb2f37",
    "41d922a220ac28a4af8cbed3ffff517b",
    "471bcf065c6ed44282c5776ee78bc6d0",
    "b7e9072e5bda17e0c68db01010658481",
    "d472e984c6e8f3d4d7352125ebcc7c3c"
)

Write-Host "=== [1/3] Active & Recent Network Connections to Octagon C2 ===" -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $OctagonIPs -contains $_.RemoteAddress }
if ($conns) {
    $conns | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            RemoteIP    = $_.RemoteAddress
            RemotePort  = $_.RemotePort
            State       = $_.State
            Process     = $proc.ProcessName
            Path        = $proc.Path
        }
    } | Format-Table -AutoSize
} else { Write-Host "No active connections to Octagon C2 infrastructure." -ForegroundColor Green }

Write-Host "=== [2/3] DNS Cache Check ===" -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Data -match "45\.192\.12\.34|209\.99\.184\.50|209\.99\.187\.28"
} | Format-Table Name, Data, Type -AutoSize

Write-Host "=== [3/3] APK File & Hash Sweep (user profiles) ===" -ForegroundColor Cyan
$searchPaths = @("$env:USERPROFILE\Downloads", "C:\Users\*\Downloads", "C:\Temp")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.apk -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        $match = if ($OctagonHashes -contains $hash.ToLower()) { "MALICIOUS - Octagon sample" } else { "Unmatched APK - review" }
        [PSCustomObject]@{ File = $_.FullName; MD5 = $hash; Verdict = $match }
    }
}
Write-Host "=== Hunt complete ===" -ForegroundColor Cyan

Response Priorities

Immediate (0-4 hours)

• Block all three C2 IPs (45.192.12.34, 209.99.184.50, 209.99.187.28) at firewall, proxy, and DNS layers; sinkhole where possible
• Push the 14 MD5 hashes to EDR, MTD, email gateway, and web proxy block lists
• Run the KQL hunt and PowerShell script across the fleet; check 90 days of netflow for historical contact with the C2 IPs
• Audit MDM/MTM consoles for devices with Accessibility Services enabled for non-approved apps — this is the single highest-fidelity signal of Octagon-class infection

24 Hours

• If any corporate-owned or BYOD device with access to financial/corporate credentials shows IOC contact: treat as full credential compromise. Force password resets for all accounts accessed from the device, revoke sessions/tokens, and re-enroll MFA (SMS-based OTP must be assumed intercepted — migrate affected users to authenticator apps or hardware keys)
• Review corporate banking and crypto-exchange access logs for anomalous transactions, new payees, or session anomalies aligned with infection windows
• Notify finance/treasury teams to place temporary holds on high-value transfers originating from potentially exposed users

1 Week

• Enforce MDM policy blocking sideloading (unknown-sources installs) on all managed devices; extend MTD coverage to BYOD via MAM where full MDM is not possible
• Restrict Accessibility Service permissions to an allowlist of approved applications
• Phase out SMS-based MFA for financial and privileged access in favor of phishing-resistant methods (FIDO2/passkeys)
• Deploy mobile application vetting for any finance-adjacent app installs and brief employees on smishing lures impersonating banking/wallet updates

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub