Resubmissions
07-07-2022 11:54
220707-n21hfahhg6 1004-07-2022 06:02
220704-grfa7ahac4 816-03-2022 13:46
220316-q2zl9aceeq 8Analysis
-
max time kernel
2466028s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
16-03-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
escobar.apk
Resource
android-x86-arm-20220310-en
android_x86
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
escobar.apk
Resource
android-x64-20220310-en
android_x64
0 signatures
0 seconds
General
-
Target
escobar.apk
-
Size
2.0MB
-
MD5
d57e1c11f915b874ef5c86cedb25abda
-
SHA1
22e943025f515a398b2f559c658a1a188d0d889f
-
SHA256
a9d1561ed0d23a5473d68069337e2f8e7862f7b72b74251eb63ccc883ba9459f
-
SHA512
2e8324559e46cb9f912eeb84b6e80a3838c71c4d045fd0a112aa3bea7fb8efdeb2ca03990a7189f5fec8d0a3f81fdaf2a98b8bce4edebc4afdc3813739bc8601
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.escobar.pablo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.escobar.pablo -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.escobar.pablo -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.escobar.pablo