Overview

overview

10

Static

static

7

03069df811...5e.apk

android-9-x86

10

03069df811...5e.apk

android-10-x64

10

03069df811...5e.apk

android-11-x64

10

AlphaPresentForms.js

windows7-x64

1

AlphaPresentForms.js

windows10-2004-x64

1

BasicLatin.js

windows7-x64

1

BasicLatin.js

windows10-2004-x64

1

BoxDrawing.js

windows7-x64

1

BoxDrawing.js

windows10-2004-x64

1

CombDiactF...ols.js

windows7-x64

1

CombDiactF...ols.js

windows10-2004-x64

1

ControlPictures.js

windows7-x64

1

ControlPictures.js

windows10-2004-x64

1

CurrencySymbols.js

windows7-x64

1

CurrencySymbols.js

windows10-2004-x64

1

Cyrillic.js

windows7-x64

1

Cyrillic.js

windows10-2004-x64

1

EnclosedAlphanum.js

windows7-x64

1

EnclosedAlphanum.js

windows10-2004-x64

1

GeneralPunctuation.js

windows7-x64

1

GeneralPunctuation.js

windows10-2004-x64

1

GreekAndCoptic.js

windows7-x64

1

GreekAndCoptic.js

windows10-2004-x64

1

GreekBoldItalic.js

windows7-x64

1

GreekBoldItalic.js

windows10-2004-x64

1

GreekSSBoldItalic.js

windows7-x64

1

GreekSSBoldItalic.js

windows10-2004-x64

1

IPAExtensions.js

windows7-x64

1

IPAExtensions.js

windows10-2004-x64

1

Latin1Supplement.js

windows7-x64

1

Latin1Supplement.js

windows10-2004-x64

1

LatinExtendedA.js

windows7-x64

1

Analysis

  • max time kernel
    1241105s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    19/10/2023, 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03069df811976152a00c4633b19bc8a92fdddf3c2b9ae2b44dd54be2af37565e.apk

  • Size

    3.4MB

  • MD5

    fb57ea82e6dc5535966f1a828154fc9e

  • SHA1

    b9f520ac56e409da565aab1f740e4e1a13d8ac14

  • SHA256

    03069df811976152a00c4633b19bc8a92fdddf3c2b9ae2b44dd54be2af37565e

  • SHA512

    b1f7d9b639e8fc26d91ccdc2980d54160eb3e035ff87daed6733d9bc9b03be7010bbe9c28abf733b095133b89fb01c2b70a1ce0b42cc76037bda793b0f1a4b9f

  • SSDEEP

    49152:PND9RuCRJF1byCPPJ8DeCfNmOu4SmHEFLxdqs27zK5GLXVHbjGBd:Ph/JXERNmOjHkp5i1bwd

Score
10/10
chameleonbankerevasioninfostealerransomwaretrojan

Malware Config

Signatures

  • Chameleon

    Chameleon is an Android banking trojan first seen in 2023.

    trojaninfostealerbankerchameleon
  • Chameleon payload 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.hair.pyramid
    1⤵
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4154

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hair.pyramid/app_DynamicOptDex/uI.json
    Filesize

    792KB

    MD5

    2ab9b49217068a1079d19f26d6f08ece

    SHA1

    0cec42706e30f777b6981dfd05405df8986238b6

    SHA256

    a89cbe3a7dae929d40d5408fed5ffe0081069e7577e2244ee7d67af633b39d78

    SHA512

    4a5ad389d7dfdd2ef58668726a93f0d14928265c514e42efacbbb2db8d37c47263377d34b57068cee99c17b20a47947aaa603ad6bc0e74029aaa09ec6b5adb30

    Download Submit

  • /data/data/com.hair.pyramid/app_DynamicOptDex/uI.json
    Filesize

    792KB

    MD5

    d1f8da5b8ced88676c523e03671feec6

    SHA1

    5981669e058e2dce153e0d65dd2843419268c4cb

    SHA256

    188f1538cf684332a2b86ccac50959a2d19af7bdb6e9666e364840eb2b9259b8

    SHA512

    20c148efae4ce28687a3bcf5449e5bf0e7c18e4584120b582d5b71bf081f8b60a8997290f1ef7e917221eff68ba3612dcd03578dbba6f6d1f73db989cee790b3

    Download Submit

  • /data/data/com.hair.pyramid/databases/ffffffff-9c5a-4905-0000-000011ed44de.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.hair.pyramid/databases/ffffffff-9c5a-4905-0000-000011ed44de.db-journal
    Filesize

    512B

    MD5

    9163d24811443e82fe552e58de4f3785

    SHA1

    f464a440eebd5e59f946ece5f917506734180cb7

    SHA256

    27043160e07b8a2f18dacdd75fcf76d0e3b3db7f56b074509459f2a1cfb965ad

    SHA512

    66a735e11018d5099aec3775c98a2420517482990f13bf7ee780cb428c7eedae23894be5f34de318d0cfe9f8cf704d4cb51ccdc7031b1d941bc9c19c699b455c

    Download Submit

  • /data/data/com.hair.pyramid/databases/ffffffff-9c5a-4905-0000-000011ed44de.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.hair.pyramid/databases/ffffffff-9c5a-4905-0000-000011ed44de.db-wal
    Filesize

    60KB

    MD5

    7dbf95de53ba0422752f2d045ca9589f

    SHA1

    264f997211e74e64254e39f3d510057f7bb4cc9d

    SHA256

    9ad90fb6d447c864ce72dde887f984f91a3fa5bd267fef95a8217f2294c8a179

    SHA512

    2b7cc87caa797d6fd0457701504eaa7b4dddf012dee995630c69d1265167d38f0a826ddc19fe99bc35c5a5b2494d21d89c1a7c4e6f8fcc0d89deb8f6ce8e0313

    Download Submit

  • /data/user/0/com.hair.pyramid/app_DynamicOptDex/uI.json
    Filesize

    2.1MB

    MD5

    e93ba6364ed4ee4174a62e15d10f88d0

    SHA1

    1542fc8a7076f0ec687ad5d3a0d866a2590b76fb

    SHA256

    879981bf91de6624c5a6eb75b6e90241883d671c320efaa5a3a6cea8b758fdde

    SHA512

    d84faba5079a68f4b5a1678a1660a01ed78022bc1e2a337a27e47b187a53ffac820393edce79d9f731eb8641d8b53aa2f136dd8d97b748c56198f58ee5114700

    Download Submit