chameleon | 73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7

Resubmissions

28/10/2023, 22:00

231028-1wt5padf8v 10

Analysis

max time kernel
2018542s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
28/10/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk
Size

3.4MB
MD5

f7617bcb03611a9cd4293cf6a40ae6ae
SHA1

fc25603c2252570f09840a9e1ff7df6179f54359
SHA256

73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7
SHA512

dd55a9d8cc18a1d7b4188cad9e1d766603edaf4077b0cdf25b6f0b72220197ca8e439e777b447bbdd44564284b211217eca15a9b78aed075f65b532b4bacdb1e
SSDEEP

49152:DcxIXkKQpIPR2rPJ8KerfNS59HQTfiBTgWIPenQg9auDBCBxUcrQnRcq:AIXkKQpO27qNSnowcBABqbQnR

Score

10^/10

chameleon banker infostealer ransomware trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 2 IoCs

resource	yara_rule
behavioral1/memory/4335-0.dex	family_chameleon
behavioral1/memory/4300-0.dex	family_chameleon

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json	4335	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dolphin.fox/app_DynamicOptDex/oat/x86/LMLeS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json	4300	com.dolphin.fox

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dolphin.fox

com.dolphin.fox
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4300
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dolphin.fox/app_DynamicOptDex/oat/x86/LMLeS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4335

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

Filesize
818KB

MD5
6bfc64789a15d6dbf1298ed049d1d766

SHA1
4a97fe8a3828595206d7860f33817b65756b6561

SHA256
d22a92680f916e36fc53f66468214ddcc386883a5ba42a958a040f96dd517582

SHA512
840b9190f7fe8a72c5c9ed9b31e0f8995d977fdb8567ccfe2a6158319a303015c457fe0e6d9d3a0eae3af637118b686241ba2b6356acab637fc9526d34d949b7

Download Submit
/data/data/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

Filesize
818KB

MD5
2bca4c2a967f87e9d251ea04a697e408

SHA1
aa85abdf41a2b48ef232ef16f0fdc1ff298cdbcd

SHA256
07cc8565f8731edb05111801cbfc531376b5f62eb29793f1cdde85b0ff786eaa

SHA512
97b4e9d28a00b0a22e6d45798bb1d7aa28eed9a2e15cafc24d61dcfe814237c4d61ccd90dd9594ce75f16a398732014cab3301d747d9cac3709ad74b7e530664

Download Submit
/data/data/com.dolphin.fox/databases/ffffffff-9c5a-4905-0000-00004ee177b2.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dolphin.fox/databases/ffffffff-9c5a-4905-0000-00004ee177b2.db-journal

Filesize
512B

MD5
a7ae3acc29ed5a27aa374db3c0a057ce

SHA1
72ae15af9e753251f1de6fbf5cfcb01452edcb60

SHA256
51139fd7bac314437561a15402272ded57b99b4ae0d54446a95b2c9dc79255c1

SHA512
5a700eb384e3d3cda56eabc01abb6d7818185d0926a7dbf951fa58637ce6a563bada5dd34975bd6af98be84ca352b684280e39f620287ab0d2b7aed18e8e0aa8

Download Submit
/data/data/com.dolphin.fox/databases/ffffffff-9c5a-4905-0000-00004ee177b2.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.dolphin.fox/databases/ffffffff-9c5a-4905-0000-00004ee177b2.db-wal

Filesize
60KB

MD5
97b6b110654f74d6737b5390bdb8c3b3

SHA1
a8146bd67bedf911e901e1cd703f027bad37a295

SHA256
b8cc939a9c98753cb69cfad476b6e384cf13de5849fa3557cb485805d1f78f3b

SHA512
667c89778d958d32a43f8bcedc057ea2e5ec6e9673867b5d8fd8e0a77a2700810f2d7846aba20c5749fe3c289e3f3c2626cddd6aac0e1243bca545a22aa455c4

Download Submit
/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

Filesize
2.3MB

MD5
bb43ed6166f99586a1ad938d7031f5dd

SHA1
f91f824b4ffe7531ac4a89b5f74c8c79f2b641b5

SHA256
ad90e00905476707af8bc98f93d4e81cb8f7905ee81f52d93cc4fe680da8d1f3

SHA512
4466622e45407ed7de31c6a953a075057dc0395959628adc618e3880c5c731fe74911a1c12a2f5d752deaa7a5b7386e3a247a25a3e0e2c58b06e3f3bd54e77da

Download Submit
/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

Filesize
2.3MB

MD5
b978f7794c0974036d50775dd4bffe02

SHA1
7487e755615eda0b608575c69cac4994fcaa06c7

SHA256
8135a07802c46ae1b13ce436ee304005135f56c062316b3fc1aa8a556354799f

SHA512
bf15c31f774792c3ad4eebde0b14f52d69c36d45be1ad142c9939bf3c03c6b5ad3521783ccbc953ac12862a6b41ea3359797a333666407b6a2ad00771774fee0

Download Submit