Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/07/2022, 11:54
220707-n21hfahhg6 1004/07/2022, 06:02
220704-grfa7ahac4 816/03/2022, 13:46
220316-q2zl9aceeq 8Analysis
-
max time kernel
3352194s -
max time network
78s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
submitted
04/07/2022, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
escobar.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
escobar.apk
Resource
android-x64-20220621-en
General
-
Target
escobar.apk
-
Size
2.0MB
-
MD5
d57e1c11f915b874ef5c86cedb25abda
-
SHA1
22e943025f515a398b2f559c658a1a188d0d889f
-
SHA256
a9d1561ed0d23a5473d68069337e2f8e7862f7b72b74251eb63ccc883ba9459f
-
SHA512
2e8324559e46cb9f912eeb84b6e80a3838c71c4d045fd0a112aa3bea7fb8efdeb2ca03990a7189f5fec8d0a3f81fdaf2a98b8bce4edebc4afdc3813739bc8601
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.escobar.pablo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.escobar.pablo -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.escobar.pablo -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.escobar.pablo -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.escobar.pablo
Processes
-
com.escobar.pablo1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4704
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5bd91a250c1388845fd9232c7ef57d78b
SHA1b9b44fa4b7f53577a8a9551d71241870f2e429c1
SHA25680215c8a22886ef611d33cb68dc35bce644ef884dac1cc90fd90e194a47d5e28
SHA512be7d27371ba30403b07cb95d5b0632d719265e351b847af14523e98ef15df024889b14d76c98e8a3a177477c1d5024230667a6ad9407d19917b852a84246907e
-
Filesize
1KB
MD5eec0eaaef8e2084bab3d0e2512424db9
SHA147e8c1048e233b5f3e9f13bcf91b606f1d403c9a
SHA256e34b59ae0126ec4c46a15bc6706c83e9218aee5b30f1d275c063c76f332c41f9
SHA5123057921d3183eb295b2f303d76c5471b9ae608bc3aad623d0e8025310233b34540958215ebb7ad14f0379c756e1827d43c6a09ac43ddde8d1c3c29968e3d84a0
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD549fd7a95551e56a5539ebda8f2b63255
SHA1ae8a763038c9932bd46bc6a0452fcc407401f075
SHA2560173789d8053e89e7893a3944d7e03490a1ccb8703543c549b05ae967dc8d073
SHA512a6bf548970ccf6a0f51c0cd6480ea906874a55b00015acd41aa6c31eb7fdbd8b69531adfef9c88524d3ba62281f4f990195bac02db097808dbe819dc5a7f93b8
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD548a76b72b78cadf3c9a47e23b9ae5d6d
SHA139d21c2725a649c0faed5b6e849048d734a2f5a9
SHA25685a1d3c36007b41b4991f05625990dfcd24cb1b8b92f7a57a84b89d199091e07
SHA512b2594fc72ce45282e7e6659132ba8afa5a0403bf8829a122179c566e9e22fc72d34220202261ed9eff2835ea64f821c12e841e0f18b923c073c7fdeb9b6180e3
-
Filesize
36B
MD54ca522c722d41236f69117b681654042
SHA1b21a452ea2d8984a9ae97cca37aa84aad202f359
SHA2566f1013aff802a9807f30683979aff27b333bed71d29bcaa5503ecb2052da672d
SHA512155b8051d830798e9a700cfb5bfb1734a14fe50bd63da78778c1043ad590109efc04d920aa4a0c4b556955989c04812841fb4ca6fd1a169b2e7cf9a3e625f4f8
-
Filesize
57KB
MD51cb520812ee898b0053add3f21fd4e97
SHA14b193d816ac52856000adf6d340e47211b95d867
SHA2566b812395f6b92d33263e433d510fdeb24a48fca2a16e649caf5c9377090d0d1a
SHA5120d0dd5cba9135dcd291d47e3d7ea0e1b3c40204c84fbda9502332e0ca9b50a8bd9f11d50eed621ed8160ce77b916e1965f5933b62503293ab2219d8742a27642
-
Filesize
101B
MD59c67d2c585b2345f38f429f55a9867d0
SHA1fe27bba31233b718418ac9f0f34f7ca26c771e33
SHA256a7cbdf49a593fe93b477cc9467b114d38f70811718191e5d5d5bfc2f7048e9de
SHA512d6d6035c4cd95c21c68309a811c1c9af78c0a3a6f10ed8f330a9fbf2fc04a2ee8aa56680f353beeec89719d21a5e84c7683595633a981a74c71c45b51b2621f2
-
Filesize
441B
MD5d71db9588a116c0fefa7b7253413e69c
SHA1515c42adfe3dec1d35522758f5bd07697c449a70
SHA256958960075d423eb1d9d508426351419248e627abd23bf051ba1cb60aa94fda17
SHA5124cfc185fec6c16e6f1b42dd01c1f1028fc3a7b4509c083d9cd9414c4d95a88113103e6463bf026270fd8ca7747a6ca87b4a1957bd32d0e8e684942f44e8a2cd0
-
Filesize
132B
MD5543fb288d98972a5dcb0ef71313c9296
SHA1ca4477809cd19c5b68dee061f4a2b5a81b901f01
SHA2566c4d15f32ae3a88a851525d225ece67885eb64a19c9f937007bbb21b694b797a
SHA512522ffb5665a0eec2f6058cf5d76ea047f969b5650e6bf1906a83434f5ce52e48d172f62531617145aeae794ec605a9e918c1613e2bcd18d819ca189d20e71dfd
-
Filesize
132B
MD5543fb288d98972a5dcb0ef71313c9296
SHA1ca4477809cd19c5b68dee061f4a2b5a81b901f01
SHA2566c4d15f32ae3a88a851525d225ece67885eb64a19c9f937007bbb21b694b797a
SHA512522ffb5665a0eec2f6058cf5d76ea047f969b5650e6bf1906a83434f5ce52e48d172f62531617145aeae794ec605a9e918c1613e2bcd18d819ca189d20e71dfd
-
Filesize
7KB
MD5ef718f13729528ecf77e5bb58bea6a68
SHA1f1382c93c15ede1c2f88914b363ccb97f98272c1
SHA256c9f4dd5cd4dddb104b6a56ed0608fddbb6f3198374a7793a0632cb61072d895c
SHA5121bd729702eeeb411e81694e713663f149daa8b9a9d28e486877d7421e9060e8d8cbcfe6b5ec92a3b99ae2559d54a2bc9fda440cd66b099bad5ca251f3c7215ae
-
Filesize
742B
MD5e64c86c0b9e73954ff3917600f7c4caf
SHA1a8f381aca05d7e2c97ff6cbd1aefab7897176fc0
SHA256eeae373aa4b35cede93ba9e52e59da7784755ae0b76bf303ce76d8d4d0b41d75
SHA51243f061425d1b0456d5823270c3fb0206346cb8d777738cb6e6fef75efed857e4c25bc6e6ffc4163ccc3163b1a12b82140aadbf6fd167ba68c187186e83b23d82
-
Filesize
8KB
MD5cd207caee9521feb3fddee6bea945587
SHA18878d6c16a138523f7ad8aab3761a3d2fac2a8d0
SHA256bd5dc335a12af0997c7d48f97bca84dc3463338d3dbbc184954aeaed3efd378b
SHA512301c198634bab9553d008562850d560e0a6ce1b9e9e05c0a4b28e54e47416162d25cfff96f1a2b64e71b2a0f1f8b85d8e07d2b59b6af63ae2679d9b58e1f99fc
-
Filesize
838B
MD517f0453498a01a7f69b4c2f3eb3008b0
SHA1b239770105deef99fd3ea6b042dd6acb479c04d4
SHA256b85732d771cc424028db4b1e9d7ea59a28798629c407ace4a56aeb4adccd55e6
SHA512f4627613b9329463f5da6ae5c6617ce151e28810e4be95a0d0fa1cb7d2b9f43da57cce981b4d90cb27ac16ae0ae776c39a9e447566860cd85658e36ddb6c7a02
-
Filesize
5KB
MD522670bdd03346b44274f4fb384c8c928
SHA15b565846fda874a8bf1cfe9bf217bdecd48c7dcd
SHA256c809e2eccc784e0ad9795835bf047753f19c5b659efd83fc44a6b80d818f2ccf
SHA5126330def48c74ed9e8575a8ea2fb4cc9fda0df7a2fbe892d57b4e1a0844b0ab45404eff054597a089f5c0671720c66a0787a6a3320a8f0d18fc93a280c23e9e71
-
Filesize
154B
MD50fa80e9452dc369dcecaeecb798cd430
SHA141089972de9d06699cd1164c07e5f7d3d43d00ac
SHA2562271e137f4420b910f494a8844c7751983b404e5fb3572e0047513407f92ebc8
SHA512b15bea022232f63b27e8635c0382be8abf6ad23b82af8f982b0c0aa2b82ae32acc799b432367bf6dfd45723b5b8ca72daabc632ecc6c810d6a510c1bd23d1325
-
Filesize
9KB
MD59af3843d547e1750a5b617b6f495b87e
SHA1c94665f7a2c2ec085fb18d1dd97d261e90430d22
SHA25665d87bf5687aeaee082ed979a5f5d1eb1f7fc52b8276ec5a55b55318a8a8612f
SHA5123b5bdb54a9c4fd9dd6176386fc76a9514b710915780e187411a09ee1b9f09517a5ad9f8f1e2d1e21c440fb4a6de0563621579c97f074918700dfd723bd075842
-
Filesize
142B
MD5f6f5f6747305cdad7a2c8a1ea1d65f4b
SHA118ae739cd0c8f55599712e38f0ce92dc557c6859
SHA256501bba3a1833a8ca0712a34dcaeca7d8f71cb9aa8623ed8d0ec6a591f0f367fe
SHA5120c7201a1a70cfad8007f293e4e52e87a2723df7fc19718821238d3e19241a48fac0b6c9e0e40a3d941ded5ea3c130aa605b8817a69316293c8a06d54c4621982
-
Filesize
142B
MD5f6f5f6747305cdad7a2c8a1ea1d65f4b
SHA118ae739cd0c8f55599712e38f0ce92dc557c6859
SHA256501bba3a1833a8ca0712a34dcaeca7d8f71cb9aa8623ed8d0ec6a591f0f367fe
SHA5120c7201a1a70cfad8007f293e4e52e87a2723df7fc19718821238d3e19241a48fac0b6c9e0e40a3d941ded5ea3c130aa605b8817a69316293c8a06d54c4621982
-
Filesize
5KB
MD57342bd73041bf58cc519b0602564b309
SHA1396d558cb31cbc2db0be18ddd0d22fc1660b56be
SHA2569340c3ba0fabcad1a9cfe6f649e553433ef53d624c5ccb8555d73a9e58567ae7
SHA512f45a31db2b72b67525c7ebf55c611a76205389f3af26b17678020ea5fc5e56f1fb3dbcd7874282d801d3fa162ba22169154408f176dc78010d02556f211e8d1d
-
Filesize
9KB
MD5e6851e25fc6cba053ba205899767f6a6
SHA1b9e5ea653ed52b44de4b8fc4f3132e9d94d9bbf6
SHA256f0f59d414bcc26adebfe6e4ac3f7622388af36457600aa04e92a52261a1b4240
SHA5126ddd0e257a3d8ec4a5c427170686b93f41e7e585f66d853175c09481de3633abeffa44e64157621e5968cdaccd4385ba7b3bf306f97bf127e068cb2d8296fcb2
-
Filesize
5KB
MD5d47be2e73e598fc272ad1fca41d6a47d
SHA112ac34de16500a099fb0873957c68315f02d258c
SHA256ab30cf721f391a02766fc1ec4967c8f38c41c79c62e49d4a4ebfe87fc95b72b2
SHA5124232e232f7d2ffc2e21ded044dac7407cc132c31954f4ada1c8ab23045c343fd5c6f1acd0945c2f072ae3b34838e51c37511a2cd370c89eb6c452445ed5bc6d3
-
Filesize
155B
MD5be88c463a8778ec870a7508d24c9413e
SHA104450c21de349259e006f388ec1621e5f12cc17f
SHA256b9fbaf3130f86816f981d0dac9fe12d6463b0486df0f4b0312d5f188526b178f
SHA51262aed5817ebc31cda4366b410616664ffff2bd6b203dcf214079677a30aabf2e9d614701940b3601bd7decd0e2ebec0ed1be4df7db2d5aaf2865fa664e4074bd
-
Filesize
155B
MD510dba5d8f411c39450f0048bd7a26dad
SHA1fc4cb5634056e582466491d02a745eb1c6d446ac
SHA2566734448c45f2e4a39017a301b34cf4ead6f089b5ebcde873c6ad7f88274f68f1
SHA512427e81757bb36851a3c8f4c522c3312756c02f321154ba2442607a4b83885d3386b58edb03a524bb0cd0b17df4e2e1aebf774803ec5544b0615c9da51d6aa4c3
-
Filesize
154B
MD5b4126cafa4084ed1c8a222f9932d1b30
SHA10cdb674d4114e43eb07ec0bf67271f33699321c4
SHA256fe89d0f244e58d5cdfc01aed24016505acb420dd2c6d985f8800fb2645f9aba7
SHA51237754141d9c0b48f176901c097fbf16da0beedebc73ba1156be93611ff9e079c6e260592619e72c6591b40532c9817467176f15412322d727196684ddcf43efa
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD533f6127acdac277526f44af903d7f5c3
SHA13cb359ac5ff73a7bb7318890a5e41d3aef289248
SHA25648e82bc4c9c8a37df28b91ea26626ef8037e6a79367e0720c20c0086822a40ca
SHA512c4adb6170acd16d8ae15c8c7680ac70eb153a9e118f4c1dd2b91c7c3a0e768a2c2c5344a448a0580a765b7166fd504cf1849d46993923f9878c65e58d9c16506
-
Filesize
216B
MD550688cf8753f5a6515701e4729eb5525
SHA14f15887672f9d8583de4f12f23e9653256e47564
SHA25626d0251c4a6d92ad15dd2a9dabeb242039aa437e9a8824df446b9ad8a6a28e5a
SHA5123b5eda15a841063df9050d401f3553354acd63d0fd6befbc3756432cf51c3b568694abf9fe41647c3a07cb2935b1a91485b4195daf35611361b2c230c5a507fe
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48