Overview
overview
10Static
static
773545a9f45...d7.apk
android-9-x86
1073545a9f45...d7.apk
android-10-x64
1073545a9f45...d7.apk
android-11-x64
10AlphaPresentForms.js
windows7-x64
1AlphaPresentForms.js
windows10-2004-x64
1BasicLatin.js
windows7-x64
1BasicLatin.js
windows10-2004-x64
1BoxDrawing.js
windows7-x64
1BoxDrawing.js
windows10-2004-x64
1CombDiactF...ols.js
windows7-x64
1CombDiactF...ols.js
windows10-2004-x64
1ControlPictures.js
windows7-x64
1ControlPictures.js
windows10-2004-x64
1CurrencySymbols.js
windows7-x64
1CurrencySymbols.js
windows10-2004-x64
1Cyrillic.js
windows7-x64
1Cyrillic.js
windows10-2004-x64
1EnclosedAlphanum.js
windows7-x64
1EnclosedAlphanum.js
windows10-2004-x64
1GeneralPunctuation.js
windows7-x64
1GeneralPunctuation.js
windows10-2004-x64
1GreekAndCoptic.js
windows7-x64
1GreekAndCoptic.js
windows10-2004-x64
1GreekBoldItalic.js
windows7-x64
1GreekBoldItalic.js
windows10-2004-x64
1GreekSSBoldItalic.js
windows7-x64
1GreekSSBoldItalic.js
windows10-2004-x64
1IPAExtensions.js
windows7-x64
1IPAExtensions.js
windows10-2004-x64
1Latin1Supplement.js
windows7-x64
1Latin1Supplement.js
windows10-2004-x64
1LatinExtendedA.js
windows7-x64
1Resubmissions
28/10/2023, 22:00
231028-1wt5padf8v 10Analysis
-
max time kernel
2018542s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system -
submitted
28/10/2023, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
AlphaPresentForms.js
Resource
win7-20231020-en
Behavioral task
behavioral5
Sample
AlphaPresentForms.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
BasicLatin.js
Resource
win7-20231020-en
Behavioral task
behavioral7
Sample
BasicLatin.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
BoxDrawing.js
Resource
win7-20231020-en
Behavioral task
behavioral9
Sample
BoxDrawing.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
CombDiactForSymbols.js
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
CombDiactForSymbols.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
ControlPictures.js
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
ControlPictures.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral14
Sample
CurrencySymbols.js
Resource
win7-20231023-en
Behavioral task
behavioral15
Sample
CurrencySymbols.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
Cyrillic.js
Resource
win7-20231023-en
Behavioral task
behavioral17
Sample
Cyrillic.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral18
Sample
EnclosedAlphanum.js
Resource
win7-20231020-en
Behavioral task
behavioral19
Sample
EnclosedAlphanum.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral20
Sample
GeneralPunctuation.js
Resource
win7-20231025-en
Behavioral task
behavioral21
Sample
GeneralPunctuation.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral22
Sample
GreekAndCoptic.js
Resource
win7-20231023-en
Behavioral task
behavioral23
Sample
GreekAndCoptic.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral24
Sample
GreekBoldItalic.js
Resource
win7-20231023-en
Behavioral task
behavioral25
Sample
GreekBoldItalic.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
GreekSSBoldItalic.js
Resource
win7-20231020-en
Behavioral task
behavioral27
Sample
GreekSSBoldItalic.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral28
Sample
IPAExtensions.js
Resource
win7-20231020-en
Behavioral task
behavioral29
Sample
IPAExtensions.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
Latin1Supplement.js
Resource
win7-20231023-en
Behavioral task
behavioral31
Sample
Latin1Supplement.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral32
Sample
LatinExtendedA.js
Resource
win7-20231023-en
General
-
Target
73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk
-
Size
3.4MB
-
MD5
f7617bcb03611a9cd4293cf6a40ae6ae
-
SHA1
fc25603c2252570f09840a9e1ff7df6179f54359
-
SHA256
73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7
-
SHA512
dd55a9d8cc18a1d7b4188cad9e1d766603edaf4077b0cdf25b6f0b72220197ca8e439e777b447bbdd44564284b211217eca15a9b78aed075f65b532b4bacdb1e
-
SSDEEP
49152:DcxIXkKQpIPR2rPJ8KerfNS59HQTfiBTgWIPenQg9auDBCBxUcrQnRcq:AIXkKQpO27qNSnowcBABqbQnR
Malware Config
Signatures
-
Chameleon
Chameleon is an Android banking trojan first seen in 2023.
-
Chameleon payload 2 IoCs
resource yara_rule behavioral1/memory/4335-0.dex family_chameleon behavioral1/memory/4300-0.dex family_chameleon -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json 4335 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dolphin.fox/app_DynamicOptDex/oat/x86/LMLeS.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json 4300 com.dolphin.fox -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.dolphin.fox
Processes
-
com.dolphin.fox1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4300 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dolphin.fox/app_DynamicOptDex/oat/x86/LMLeS.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4335
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
818KB
MD56bfc64789a15d6dbf1298ed049d1d766
SHA14a97fe8a3828595206d7860f33817b65756b6561
SHA256d22a92680f916e36fc53f66468214ddcc386883a5ba42a958a040f96dd517582
SHA512840b9190f7fe8a72c5c9ed9b31e0f8995d977fdb8567ccfe2a6158319a303015c457fe0e6d9d3a0eae3af637118b686241ba2b6356acab637fc9526d34d949b7
-
Filesize
818KB
MD52bca4c2a967f87e9d251ea04a697e408
SHA1aa85abdf41a2b48ef232ef16f0fdc1ff298cdbcd
SHA25607cc8565f8731edb05111801cbfc531376b5f62eb29793f1cdde85b0ff786eaa
SHA51297b4e9d28a00b0a22e6d45798bb1d7aa28eed9a2e15cafc24d61dcfe814237c4d61ccd90dd9594ce75f16a398732014cab3301d747d9cac3709ad74b7e530664
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a7ae3acc29ed5a27aa374db3c0a057ce
SHA172ae15af9e753251f1de6fbf5cfcb01452edcb60
SHA25651139fd7bac314437561a15402272ded57b99b4ae0d54446a95b2c9dc79255c1
SHA5125a700eb384e3d3cda56eabc01abb6d7818185d0926a7dbf951fa58637ce6a563bada5dd34975bd6af98be84ca352b684280e39f620287ab0d2b7aed18e8e0aa8
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
60KB
MD597b6b110654f74d6737b5390bdb8c3b3
SHA1a8146bd67bedf911e901e1cd703f027bad37a295
SHA256b8cc939a9c98753cb69cfad476b6e384cf13de5849fa3557cb485805d1f78f3b
SHA512667c89778d958d32a43f8bcedc057ea2e5ec6e9673867b5d8fd8e0a77a2700810f2d7846aba20c5749fe3c289e3f3c2626cddd6aac0e1243bca545a22aa455c4
-
Filesize
2.3MB
MD5bb43ed6166f99586a1ad938d7031f5dd
SHA1f91f824b4ffe7531ac4a89b5f74c8c79f2b641b5
SHA256ad90e00905476707af8bc98f93d4e81cb8f7905ee81f52d93cc4fe680da8d1f3
SHA5124466622e45407ed7de31c6a953a075057dc0395959628adc618e3880c5c731fe74911a1c12a2f5d752deaa7a5b7386e3a247a25a3e0e2c58b06e3f3bd54e77da
-
Filesize
2.3MB
MD5b978f7794c0974036d50775dd4bffe02
SHA17487e755615eda0b608575c69cac4994fcaa06c7
SHA2568135a07802c46ae1b13ce436ee304005135f56c062316b3fc1aa8a556354799f
SHA512bf15c31f774792c3ad4eebde0b14f52d69c36d45be1ad142c9939bf3c03c6b5ad3521783ccbc953ac12862a6b41ea3359797a333666407b6a2ad00771774fee0