Resubmissions
07-07-2022 11:54
220707-n21hfahhg6 1004-07-2022 06:02
220704-grfa7ahac4 816-03-2022 13:46
220316-q2zl9aceeq 8Analysis
-
max time kernel
3632587s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
submitted
07-07-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
escobar.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
escobar.apk
Resource
android-x64-20220621-en
General
-
Target
escobar.apk
-
Size
2.0MB
-
MD5
d57e1c11f915b874ef5c86cedb25abda
-
SHA1
22e943025f515a398b2f559c658a1a188d0d889f
-
SHA256
a9d1561ed0d23a5473d68069337e2f8e7862f7b72b74251eb63ccc883ba9459f
-
SHA512
2e8324559e46cb9f912eeb84b6e80a3838c71c4d045fd0a112aa3bea7fb8efdeb2ca03990a7189f5fec8d0a3f81fdaf2a98b8bce4edebc4afdc3813739bc8601
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.escobar.pablodescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.escobar.pablo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.escobar.pablo -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.escobar.pablodescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.escobar.pablo -
Removes a system notification. 1 IoCs
Processes:
com.escobar.pablodescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.escobar.pablo
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
88KB
MD58874668f4e132a463926b32474b9605f
SHA19081ba6c169086b9c932b127ab9f57a0170c0758
SHA25621826e96f50448a38edc07288d98f87d0a4401724b59dc0543cbf25d73192903
SHA51281243d6f71ec9074c8391e8358f2a65f37158e72860cb8a847ec5ebe815187e8fe4b87b96b2ebc3df3250d9e66e129468c084038113cee3dc8d8f1c9c394331d
-
Filesize
1KB
MD5dd7add1ca2b5489ebccb90d80dcd01dd
SHA120719d1acab6d2f3551b72be1f88a4f5051eec2b
SHA25663b273729e52cfc8dd41b23379202451640f4df4422e4f3ed069f2e7f9173cae
SHA512a3f923f49cfe1bd5e39e4d3f91444f4f79fbb9dc3a68b233576ebff680a9acdf078f556f6fff1e6f8ec041afae474d67363883ee311f3dfe11574c21fad36cd6
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD56a7fc9d19918cb26a03be9ad52b0419e
SHA15687da5d5aee728ccd78e26b2207b3fb01e30494
SHA2569f7e4b497ddf8a62c48346abeb702f3b77ce7d78fca8bb1cd6cc820e2ea7b3df
SHA512a81c1f2816dd9450f29dc774ea92611c696cdc447d1ab1d91553fba8e80951fe9ec51fcf30b91bd4a90bc91209cbeda17bd1d5f3905ce145a51510e980cd6b0c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
61B
MD59f7eadc15e13d0608b4e4d590499ae2e
SHA1afb27f5c20b117031328e12dd3111a7681ff8db5
SHA2565c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
SHA51288455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
129B
MD5743662704661c5d876f44d0ad7acf0da
SHA16c64f9ae9ef27ac0b9934a2ad18516150b386235
SHA2562905ee1bc695ffde5a2b00226ab6c57b801d18e36cda054977c3140abc6072d7
SHA5126d24a74f5335f361886ca19639c29fa9632a074d8bc126e613e2148dd21526b8f2a3f6bf6d614cdd5e76d8f8ba6d25ca3cba788bea39ce18df2227b1060b120f
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
120KB
MD5a48cd9324b1f8754b07f00d863b840f3
SHA111c6614775b35a58f440971dfc87c8aaac6d6173
SHA2568859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA51235fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1
-
Filesize
2KB
MD557a1ee9270247cf66fbf3d85c9fdcc02
SHA1b01a45978064f581e2a7253f4bc48d1574c3e8f0
SHA256bd0242c908ed934f2f03b227c634f9cb50fbea7d2513a03f1b35c26f2a68055c
SHA5126cd967cadec2741e23bc2777493220f3dba07efa448be71ef94c0dc40ba5fe74cc7e91ef143fa39b6385093fa73883d5ee6c75cf0e0b7f83076d10940942ee3c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
23B
MD58bfb99104492fcf889f47ecc8c1fa83e
SHA11035deecffc4eb91c1a24d85fb1eb9b856dedabc
SHA256961cbd9ac09618ef0b4d58d3655064e672b1b49832b6f4df2c72a260f325b7a4
SHA5123851266644cfac9161f04977cca726c926c344d83b3c04723de3938aba817ecb0920418471538ef0021e01eb55308b3666d056d710e27a6896cd0df43366b4ed
-
Filesize
40B
MD589bbd77d093b24c7de3755c9e5273425
SHA105f69b7e511b04d2948d51b2fb2c99e951b2cc4d
SHA256ff4a42f22f0e9632766176a0d974c84590139877a7c744791fbd59bb5ae27b94
SHA5121332765dd0e6869d68a4d7e9e6112dfd9dc62cdbf1fe10a986863934af70fb725acd5ab97bf390cd31842507b373d43074119a204fdcb0ce13651653f4f483bc
-
Filesize
113KB
MD5840834f7ef1565e5e48850c2701bf401
SHA108c8eeed71ceb1d645d1c9596d26da7405e8b034
SHA256924cceff67f0138e0106db864e0b12b6490a5658f8889d15cf2e7b2039ed7642
SHA512eb17efc6c0fbd2f0c0642dd4b84e53c79a7c7d3dc4ca29b1f81c96e0b693d30a0753c9f18b6df8a6d9d54535e16978aa1a510864c9c8357b6f79565581fc6934
-
Filesize
14KB
MD55982a13798692fb4614b6aaa1e5dfc22
SHA100fe8b49b9ab82a4769f879bb4577b112402737a
SHA256a694bf1ee014f9840649f1eda5c862a36abd50c9df2da2358a93b520245a6828
SHA51298b94fa305d0eeab4b207a98336017ee1ef22ee822b017e6e5113fb8b00a082d0bf06d33fd4203a34ed47a32042cb03c55e52742a5fa40f779424c579562346a
-
Filesize
898B
MD5c8a179654f502b0d20780f6a993ee080
SHA1b09d818dca403c6a05e093b859faa32522273994
SHA2566f442bb88f981b94d3bf00bd15d52606b5cee9b7a4a0d888c4dd6c70cc07633b
SHA51277999b169ffaf9be6ab6be7459c14765338d3575b40efd3f569f7e6aaa457e0e43400b1734c4b7db28a17f1b77c4acb85f27dccca80146fa8988a52164f9434c
-
Filesize
288B
MD5a1815ab49d29b6ecd2ee9c1e0025aff2
SHA17b46758633f5a7ae3a0531fb0d0e28507c6f9a63
SHA2565209febf3831b681fa617113c35fec4a426e73b1694e06e18b6e651e19381893
SHA512ac91a7d0cc6e0a438bb47a0cc54749b7a1105282c7fcd0aa1cf867704432de58112521f7d7a87d257724790d5ed6c8d2653f651b346a76823576e094cf0cd2f5
-
Filesize
9KB
MD52dafcc984e44fca59de909f0d2b48821
SHA1e79a402e1a482d043668f0b935051f3cc4e83ef5
SHA256256827c7d1d9ae74e939a6dd71bf0433093661aefdc49ec381d31055ee8b7e6a
SHA51227cf65eec5e9be1d7f2c503cb9ee15de767013db534a120d8bdff5f2b2950b64c9e4667cc0171d3a0fe38f3f9d868a0f9e72ccb5689f6a836f0283fabed3bd9d
-
Filesize
376B
MD5b0ff6633cc138c5ce3c2a5bfca30a672
SHA14b216e4b59170da19b607bf83ad5333625f1271e
SHA256fcf12db2abcd8cbfb0293e567f93235b85abd7976fe7d58078bea97bb6e89c13
SHA51226392b5877aea4a77f4637784c7a33ab6ac435ef1046b6a8ff51e7edfdf5ca767bd33726b6b115a8c4cf5d5d21a3d2207dec0d2e15ebc83a46353524b6ffb9ad
-
Filesize
366B
MD5e6536df6f25bdda8ebd8bcb48383403f
SHA16f9dd49d376be87fb9bedd7aed17e5b17ecb6aaf
SHA2568d88a4c33a3b8e3b3c1e08bfe446a2977e4a1b92aa1ecc98bbb1cfdc87d94c33
SHA512b835bcb455c0a1e450d5cbe6651ab203c598643c2f74b488755eeee3a90c5775489c6217520dd2baf715761a53bc610941846a012ac0532b066f6890ab3711e8
-
Filesize
289KB
MD51ec4bf673007fb316ac9e8e942cb598f
SHA17f4939f82855f281fc3831aef70ac15cf447f252
SHA2565f40056621b509611cef3df29dcfbda8a6247d4926ec27661856d3d5547bf624
SHA512f4e015159489d3c9fec51ac415edf22f5f0ec4b1f65f6ae0b05cf6b4d1d2728c267b12fb77dffb44836d9808050a01b3482fae8ceac5c1e5faa4463931fe5b7f
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD5b6296b8ae9cf808a53562cf322da9178
SHA1bf33010ee09a23380fd6ce3f86836e31364033f8
SHA256c0a0389ede4f7f1ee1e6d54f5155a11b1a3b7e4e1f867a9c76e56daf05f84f79
SHA512a2f035a647cc1e06c324156cbee61c005fd5226c0a542a4d129f4734811adf360c1fab55f3ba4b59be75d621a535fc7629bd60c32d535dd91c180032442d28af
-
Filesize
240B
MD518f4370723947b6862ed0d47045e669b
SHA1b0f62982f9a5fcdf388f40dfc16ad032f20e2162
SHA256828e9386af04d1b28b9f73f3043cb1346ab8cc3d4c34bfe99a7b8406ed3008d5
SHA512880169c399da2bc35ef3bf5115cd539d14716a23f2fa9217bb8de4aaca4ade405d38aadd3253f5b662041ea24541b8eb1497dc6b161f52c91b71309d26535625
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.escobar.pablo/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize96B
MD546f48ffb5690f949256aa5eeca47efeb
SHA15194ed2fe2f2299eb54dcb3860c3658453a348f0
SHA256dc38f67820523a283b9be90935dea07b77b8982896dc4fdade7eacfbdbd9f573
SHA5122e84735da7839dfa9f2384008a924290220c7faf826410c4418601aab53caf85f741e23f602a8592a311204f381fbf90a828b7758d01354e82ae9f967aff395e
-
Filesize
17KB
MD50c565828199ee4105884e8ea777515d2
SHA1dc1b074f6a44530e8ba9b55b590ffe19ebfc5e4f
SHA256dd945db36eb8255d27884d28008b5a1f196ae4b7d90c763984484fa05bfec2bf
SHA512fa9d828080ceb5eec69fe047e2e3e9e6d8e83d4094b8c9cc3902d6c0e7cab037d9d3259f26165e80e3dd4e7bd8d84e2f0d73c104cbf8509c70fc3ca26f1dd5ac
-
Filesize
308B
MD53329008cfbf04ce18c95985b2cde258c
SHA1511a947c087ad9f662b1b0b50807159f357909d3
SHA256d3133253a114d931f0ecacd6018c6b6694b9111a84522a2b6c4bb9ec97a513a8
SHA51295753fab0fa12bb653a8c5422161de286b725a7816de4ed8ea446e3ecc38fc58097b99f579e3dbd1ae0559e4ab7240fe4b6fe2f12cfb0ef4525575d4a6469ce5
-
Filesize
17KB
MD5ae26918c0b873cb6484845706a7269b0
SHA10153c2ff7cb0495de95a7dd4bbdc860c18a82522
SHA256cf93afc650dd5996d3be0ed310cad691d5da48746cf1364d0b4c60a2590b42fa
SHA5128e455d92993c30047117d9101c5f7d8f0ceb9ddf9e8bee271df0ab81a953867b90c8cac8dc21e455f7fdbc67c32dccada134f40df8ac7afd4035013ddca8422d
-
Filesize
10KB
MD56f7f99708f45eb683bf32dfd91dc08ac
SHA1e5fa1a9b01a7598a158e8d4233d5b68cbdb1a152
SHA2569d6640f311792bb2b2e6df7aac94fa88d1316f53cd03857aa52da6da9d7ad9f3
SHA512cdbb4dacd28d0f347656a8888fe49294d80e412595fa027b2922cebf139d4093dd5be273b8fa02e4feed85c05d7f4e2376ec8cbfbcf8a3c68db2a3de65e2a799
-
Filesize
332B
MD56ecd3d0ea9edc1b933851b8a6cfb92c0
SHA17a4b1c003a6429ee4f1f1157d24aeed44d061ad0
SHA2567de17458daf6741273948477d50ef1b74b3019f55063ea4b184dc0ab0b89b1bb
SHA51250639540c0cf11c078409c09d221833e360b52d941dd2b7d5b0d2bbf91f305874838202652ac9723aeeb6cc19725407640f746cff8fd06a7ccaecb4135d44746
-
Filesize
332B
MD5ec6de97ad0c3f38f34027cf38f59ebc3
SHA1a37994ac031e91195f1bd9f8588d48c8cfa84ebc
SHA2563d15806186d11061ba2894849077b91819b01c52daa667213ebbb5a9ecd18d91
SHA512d572553a36a999847cc638e386296e26acbb86e33cd02435d0b9e72c13c6f6c2e2184da37b0b92aacd50258c33210a048c9fac635a0427ffc0d2618340f52292
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
144B
MD50b063af8ca1764d97804ea08e9fde621
SHA16f71b7575baf3c7a8b22b65203cf33267d31de6a
SHA256a656901243bfede724616008eb77e10e91e29eea56d5a0041ee50bf54fa7cd8c
SHA5127a985426d8a6e7473baf4a06573f4188a38cccbfd099082b926ecaffcc7e58f41ce0a963038e748057c322eaf13dd81bf05b1491903060be08538d1d261f63df
-
Filesize
432B
MD5a00effaec51c7ebf1fb478bb96e586de
SHA123fe3b2fa4c3b10790e8c08c5dc01a3408200599
SHA2569b96a8350d9b2ae75bb94d5a0aef7294a634df7672e76157a86461aff3fa6ba5
SHA5123e33f817b5ece38e20f8c9eaa7fca52b0d28d9177a119f116e0a9a727b84daec6b13d203b09e2635525157d5ccfa7944b2be68314132a70f19e2a932adb4c259
-
Filesize
57KB
MD5f080fa2a56ab5479d58063e5ea871447
SHA14b3fd57a98916fa5784305b76ba30af26b5253d9
SHA2560aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA5128aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936
-
Filesize
127B
MD597ccd9a2b2063143df56b6937f961ca4
SHA15e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA51286c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b