chameleon | 9506de40344618d471730d70077d7f12e18b174fa52d7f6a32c040be6c9f800c

Analysis

max time kernel
3055288s
max time network
162s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
09/11/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9506de40344618d471730d70077d7f12e18b174fa52d7f6a32c040be6c9f800c.apk
Size

3.5MB
MD5

f611da9e2d55f8b99049a0668852d107
SHA1

433138f65255081d1bb07a7eb4580f0392019a97
SHA256

9506de40344618d471730d70077d7f12e18b174fa52d7f6a32c040be6c9f800c
SHA512

fb457cda4516ae3538b3fdb16f26528b1dd21c69c8fe7025fdc7a0c136d1d3a66f8bbcd52bf232504fa62bad9e2a06539ff0ca2af2935890bd0f098baf24195b
SSDEEP

49152:xQgy7OOnkWRJzGQ/dgLMLTPJ8PenfNOptT/ez8WwVsV+TFIff0zObe:xQgyiwpRZ/SGiONOPo8W6EfSObe

Score

10^/10

chameleon banker evasion infostealer ransomware stealth trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral2/memory/5136-0.dex	family_chameleon

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.fiction.document

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5136	com.fiction.document

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.fiction.document

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.fiction.document/app_DynamicOptDex/hy.json	5136	com.fiction.document

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.fiction.document

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fiction.document

Checks the presence of a debugger.
evasion

com.fiction.document
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fiction.document/app_ACRA-unapproved/.stacktrace

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.fiction.document/app_ACRA-unapproved/.stacktrace

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.fiction.document/app_DynamicOptDex/hy.json

Filesize
818KB

MD5
5e2634cd3de1cc72f3e65b5c07048111

SHA1
f843a48f250bd6c589ff8e317f5acfe6df7e63fd

SHA256
346186c7e3104c2dbd4f7e7385b4c4e4d8172ff72b67d21940bec34108929315

SHA512
39fe313daf83f3892bd43170f2b05f36f09239e430217fc3826dc26b07480fc7a3e17270e88807025148e01247ed80d76bfd4e85c270efd2b9e4fa24fd8a3cae

Download Submit
/data/data/com.fiction.document/app_DynamicOptDex/hy.json

Filesize
818KB

MD5
a3e750fba7d446fd6eb60a1096354dca

SHA1
dc1b8c2f5b0dd728608cc2507a1e3ea43c0bb5f9

SHA256
ad2d27947f1e0aeffe54b9a9ba4bac28eb149959e5bfb15868b68e8c96457e56

SHA512
2ffab2254021ac2064bf557cd1690f6774ae25d18f082c449dee78b0a818fe1d721e1fcd67a69c4172e531ccfd79d8251af78e6be54042378bfb686ac00c86a6

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db

Filesize
36KB

MD5
d990a9e4e94b23317c811dfd1b8a1605

SHA1
131c8e143326a3c920586e3e2071b72b695f5aca

SHA256
84aa8d5d5d47c1882fdbcdc1285b1725cda709d3cd0f7b3ce67a300a9f7eee0e

SHA512
a6a72f08999d15f7b995944053ec38c3eae923be66d95cb37c0e64873e65a4ac7d6c873db53c4305663a7d78f54f77e82138c2f5b231f32eb4a9cb87bbebe9a0

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
512B

MD5
583f4d9a43a8b76e083035f24e3d1ee3

SHA1
236a1684abbd39e9a42dea75ba80a8bd2e997e7c

SHA256
857615182738c4d8bdce49994826b84b36161340ae1cb3ce70c011720faab4a5

SHA512
561f663aeba22747782e8fd1f3c23206d05acae39505843eaa5b1bcc98770a94cfdb7abe873d6066b2c445601a1edde5df344339671aba1369df88c57dfb5152

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
8KB

MD5
0486dc74f59e8b9f0ee6c2e7f6b7d304

SHA1
03c4ec6a6d00688437306c3ffd9ed4c1484edd9b

SHA256
c94ac67ac8eaa3000f473c2bc2dbf0db9c733e843da6f94dcc4778efd0644563

SHA512
eb824c8ef78e78113c89f5169dcb7a4b5e19d2b955ad91c42c72c223eb380a60a191ac51e1ae4d7a34e18ef191a23b2a6eb35d7156f17b09079314b700d624e0

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
8KB

MD5
c0e2de9516aa6ed33b12f4230858d226

SHA1
6215cf7c222c7510d74f26c9006237b61d89a109

SHA256
b52e22cbb8086ddfd06eb1d8c429e0d1198761ffff344cacbca7b49a0403d8d4

SHA512
ace76b4f57aac18d3165171ee154e23c23aea9d5530f5c62358a4bf57d3555ca83ac06df8b0b793025772f7888b4d6d6934b3620e77e0a51607fa3b533ce7160

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
12KB

MD5
a147d089ab330cf545c94a8fabc4434b

SHA1
b33dfc718942c21e47e4fca5a1e0be3e0611c586

SHA256
b8e482103cfb765fdc1e1bb63c44644b4b62e8c19b5ca879716db0c6b2c9f26c

SHA512
27b33276fc7cfabcb4defb1be2657b22b600500f8bbcd3dced3fd7a7aad9cff95ff8ce642af102900785ba97fe03b6f126368ec6cf5908f1cc8b1811d853742c

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
8KB

MD5
4ace59a25841218e111dedd0ffc9e0fa

SHA1
79e2dca33fd44754bd8d7a8fa0bafc47c412a231

SHA256
30563765a94fac159a77b930bbef81df62dbd9551419a416f1fa013cf5fa7553

SHA512
7062de5df7695f7b40031cfd7db9ee6b9eef529a556caf1d96cf0d9051b70458c3fc22d2bed2ba48b6dad84e894334f4e90c2230a8d78c1f1dca4c2010494cb6

Download Submit
/data/data/com.fiction.document/databases/00000000-4f16-74ef-0000-00003616c681.db-journal

Filesize
12KB

MD5
ae5b388238046fa3e1bf55e24551ce6d

SHA1
869e3bb539019e8acbdb027b5130bde6b2fa6e74

SHA256
2882abcffe991825189ec7cb7270584bf63ad6105ed4584d8f6c3449e82ead86

SHA512
ef121a62ca0cefb294af100428076d7e9fcc37ef924a57f22bb088a35259f2a4bb8e967fb317ac3e7c8f183acead7e490b92203e7a3f98d3fbaf1a83c1b40fab

Download Submit
/data/user/0/com.fiction.document/app_DynamicOptDex/hy.json

Filesize
2.3MB

MD5
def62b23f7011a96ccf7342a9bb4f227

SHA1
cb71a49479bb732bd84f9901765cb088d3eaf593

SHA256
8dcf26818e2007ef8e5b720b573db481d1aae8061f704a6878d1a17dfa9a5ce8

SHA512
5429e85ea0653ff7867331fdb5a4240426f7d617d0fc0a9d1c745fdc9613024c9e477130b1f24f3ecd465bc2ed983ebe1a8f773ead96eb343985acf62f3e0899

Download Submit