chameleon | 153410238d01773e5c705c6d18955793bd61cb2e82c5c7656e74563bb43b3ffa

Resubmissions

02/04/2024, 07:18

240402-h5dvysbc72 10

13/04/2023, 13:04

230413-qaxzcach6w 7

Analysis

max time kernel
5s
max time network
307s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02/04/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CoinSpot.apk
Size

3.6MB
MD5

382e4022f901ebc2fa15a168a8dc5a20
SHA1

a8afa19a4aa30b144387101a58e7f52335f24eeb
SHA256

153410238d01773e5c705c6d18955793bd61cb2e82c5c7656e74563bb43b3ffa
SHA512

891b38c568d56325a51394c8676e9553534dc470b8272cdbe610ff530f63ca15b03436143f4af23141ef9580a9a90ec4d6fd1448ed5ec93130290de242162c4a
SSDEEP

49152:0CEMb7Wdu21EpCPOzbGHYBLJ/Oys84q9rsljigY2a1WQOqvauFOJ+AIibJWhL9Bt:FXb/VUP2GHYBJOyI3l2WaUqCKYSKJLRE

Score

10^/10

chameleon banker evasion infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4634-0.dex	family_chameleon

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.hardware	com.top.omit

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json	4634	com.top.omit

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.top.omit

com.top.omit
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4634

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
483KB

MD5
31bedfbe6acc616a38ef5c08b2b29c76

SHA1
6feb176ee8b54b3fa606aa93818136709b02f20d

SHA256
eafd620325f0b290f69d1e2c6a3aa443a253bd2f7906ee7ff0c17fa702c7dbed

SHA512
2c43e9219dc7d69d19bb7a5a5757f9c697d17b7ec15908952ea7b84cc42760ca85dcc56fa2c6cea972fcbba59b4d6b0476094916dae699e3d728984133220f11

Download Submit
/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
483KB

MD5
f5c6afc2a23dcac894a089599272465d

SHA1
28b389e3251b2b67e7f5f13601b65422f8f56711

SHA256
f7dc169d8656cc32cb9579ee2e6ebeabad85bff5f5787c7015b67106e57aa05a

SHA512
410aeb6ab2ab0a8b65db0ba6a8ca94d33cc9c3fac6a1b5fb46f56d6605bf8f5235a7bce2e0f53ae48464f5e91c49dbf54a15cac81da424c754994659edc1ecc1

Download Submit
/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
1.2MB

MD5
0e6e8f70702bceb278745e19c2ac2b14

SHA1
e6ea5dba97c3c1851882e120d13e43460385de01

SHA256
9e1417946a05655869642d9c560605fb8cad248f86e276f894ab0744bd428f7a

SHA512
13382ce1800d5a658a159c07c81afa5cd595db812e265d218272b26e6822f1d5975c9bfa8212d6dc11e42c406bf2bca35729eb2d18415b820fd5b7cf12179c3c

Download Submit