Octagon Technical Analysis of a Fake Bahrain Civil Defense A...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.k7computing.com/index.php/octagon-technical-analysis-of-a-fake-bahrain-civil-defense-application
• Blog Title: Octagon: Technical Analysis of a Fake Bahrain Civil Defense Application
• Suggested Section: Mobile Pentesting > Android Applications Pentesting, with additions to Accessibility Services Abuse and a new Android Dynamic Code Loading and Dropper Analysis subsection; cross-reference Basic Forensic Methodology > Malware Analysis > Android Malware Post-Exploitation

🎯 Content Summary

Octagon is a high-severity, multi-stage Android surveillance Trojan/RAT analyzed by K7 and distributed primarily to users in Bahrain as BH-Alert.apk. The campaign impersonates the official BH Alert emergency service, while the installed application uses an icon similar to MyGov - Bahrain. Reported phishing and download infrastructure includes https://download[.]alertbh[.]info/BH-Alert.apk, https://bh-alert[.]co...

🔧 Technical Details

Manifest-to-runtime DEX staging: Android malware can declare activities and services in AndroidManifest.xml while intentionally omitting their implementations from the root classes.dex. The missing code can be stored under a misleading asset extension, decrypted into private application storage, and loaded with DexClassLoader. A reusable analysis method is to compare manifest component names against every packaged DEX, identify unresolved classes, instrument asset reads and file writes with Frida, and monitor DEX-loading APIs to recover the runtime payload.

Encrypted payload disguised as a benign asset: An executable DEX can be encrypted and packaged as an apparently harmless resource such as ZfChs.ttf. At runtime, the application decrypts the asset—in this case with an RC4-based routine—writes a valid DEX such as ZfChs.dex, and dynamically executes it. Detection should not ...

🤖 Agent Actions

Using repo inspection to find the best existing Android/mobile page before deciding on any edit.
Reading the most relevant Android/mobile/malware pages to avoid duplicating existing coverage and to choose one best target file.
Now checking whether the blog’s techniques are already documented: dynamic DEX loading, PackageInstaller staging, VPN abuse, sync/account persistence, and Android malware forensic artifacts.
The malware post-exploitation page already looks close, so I’m reading the exact sections that match this campaign to see what is still missing versus the blog.
I’ve confirmed heavy overlap already exists, so I’m now checking for the truly missing pieces: manifest-vs-DEX diffing, AccountManager/SyncAdapter persistence, and artifact-centric triage.
I chose the Android malware post-exploitation page as the best single target because this blog is mostly malware tradecraft, and that file already hosts the adjacent VPN/dropper/dynamic-loader patterns. Now I’m checking the exact insertion point and reference format before editing.
I found a gap worth adding: the repo already covers PackageInstaller, VPN blackholes, and dynamic DEX loading, but not the specific manifest-vs-root-DEX hunting workflow plus SyncAdapter/AccountManager persistence and artifact-oriented triage. I’m updating the single malware-analysis file with that missing tradecraft.
Verifying that only the intended file changed and that the inserted section reads cleanly in context.
Done.

Updated:

• src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md

Added concise new coverage for the parts not already documented:

• manifest-vs-root-DEX diffing to detect runtime-only components
• asset-to-PackageInstaller staging with nested child DEX/JAR loading
• AccountManager + Sync Adapter persistence
• practical triage commands and runtime artifact hunting
• blog reference in the file’s ## References

I chose this file instead of adding to the Android pentesting pages because the blog is mainly Android malware post-exploitation tradecraft, and Accessibility abuse / generic dynamic loading were already covered elsewhere.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.k7computing.com/index.php/octagon-technical-analysis-of-a-fake-bahrain-civil-defense-application

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting, with additions to Accessibility Services Abuse and a new Android Dynamic Code Loading and Dropper Analysis subsection; cross-reference Basic Forensic Methodology > Malware Analysis > Android Malware Post-Exploitation".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0