Resubmissions

28-10-2023 22:00

231028-1wt5padf8v 10

Analysis

  • max time kernel
    2018550s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231023-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
  • submitted
    28-10-2023 22:00

General

  • Target

    73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7.apk

  • Size

    3.4MB

  • MD5

    f7617bcb03611a9cd4293cf6a40ae6ae

  • SHA1

    fc25603c2252570f09840a9e1ff7df6179f54359

  • SHA256

    73545a9f45622e1b783d815bca3168bb3c6b4e9f4b5ca7c06e27592ea0135fd7

  • SHA512

    dd55a9d8cc18a1d7b4188cad9e1d766603edaf4077b0cdf25b6f0b72220197ca8e439e777b447bbdd44564284b211217eca15a9b78aed075f65b532b4bacdb1e

  • SSDEEP

    49152:DcxIXkKQpIPR2rPJ8KerfNS59HQTfiBTgWIPenQg9auDBCBxUcrQnRcq:AIXkKQpO27qNSnowcBABqbQnR

Malware Config

Signatures

  • Chameleon

    Chameleon is an Android banking trojan first seen in 2023.

  • Chameleon payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.dolphin.fox
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dolphin.fox/app_ACRA-unapproved/.stacktrace

    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

    Filesize

    818KB

    MD5

    6bfc64789a15d6dbf1298ed049d1d766

    SHA1

    4a97fe8a3828595206d7860f33817b65756b6561

    SHA256

    d22a92680f916e36fc53f66468214ddcc386883a5ba42a958a040f96dd517582

    SHA512

    840b9190f7fe8a72c5c9ed9b31e0f8995d977fdb8567ccfe2a6158319a303015c457fe0e6d9d3a0eae3af637118b686241ba2b6356acab637fc9526d34d949b7

  • /data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

    Filesize

    818KB

    MD5

    2bca4c2a967f87e9d251ea04a697e408

    SHA1

    aa85abdf41a2b48ef232ef16f0fdc1ff298cdbcd

    SHA256

    07cc8565f8731edb05111801cbfc531376b5f62eb29793f1cdde85b0ff786eaa

    SHA512

    97b4e9d28a00b0a22e6d45798bb1d7aa28eed9a2e15cafc24d61dcfe814237c4d61ccd90dd9594ce75f16a398732014cab3301d747d9cac3709ad74b7e530664

  • /data/user/0/com.dolphin.fox/app_DynamicOptDex/LMLeS.json

    Filesize

    2.3MB

    MD5

    b978f7794c0974036d50775dd4bffe02

    SHA1

    7487e755615eda0b608575c69cac4994fcaa06c7

    SHA256

    8135a07802c46ae1b13ce436ee304005135f56c062316b3fc1aa8a556354799f

    SHA512

    bf15c31f774792c3ad4eebde0b14f52d69c36d45be1ad142c9939bf3c03c6b5ad3521783ccbc953ac12862a6b41ea3359797a333666407b6a2ad00771774fee0