chameleon | 153410238d01773e5c705c6d18955793bd61cb2e82c5c7656e74563bb43b3ffa

Resubmissions

02/04/2024, 07:18

240402-h5dvysbc72 10

13/04/2023, 13:04

230413-qaxzcach6w 7

Analysis

max time kernel
7s
max time network
299s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
02/04/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CoinSpot.apk
Size

3.6MB
MD5

382e4022f901ebc2fa15a168a8dc5a20
SHA1

a8afa19a4aa30b144387101a58e7f52335f24eeb
SHA256

153410238d01773e5c705c6d18955793bd61cb2e82c5c7656e74563bb43b3ffa
SHA512

891b38c568d56325a51394c8676e9553534dc470b8272cdbe610ff530f63ca15b03436143f4af23141ef9580a9a90ec4d6fd1448ed5ec93130290de242162c4a
SSDEEP

49152:0CEMb7Wdu21EpCPOzbGHYBLJ/Oys84q9rsljigY2a1WQOqvauFOJ+AIibJWhL9Bt:FXb/VUP2GHYBJOyI3l2WaUqCKYSKJLRE

Score

10^/10

chameleon banker evasion infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral4/memory/4210-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json	4210	com.top.omit

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.top.omit

com.top.omit
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4210
- sh
  2⤵
  PID:4239
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4257
  - - cmd package list package -3
      4⤵
      PID:4275
- sh
  2⤵
  PID:4296
- - cat /proc/self/cgroup
    3⤵
    PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
483KB

MD5
31bedfbe6acc616a38ef5c08b2b29c76

SHA1
6feb176ee8b54b3fa606aa93818136709b02f20d

SHA256
eafd620325f0b290f69d1e2c6a3aa443a253bd2f7906ee7ff0c17fa702c7dbed

SHA512
2c43e9219dc7d69d19bb7a5a5757f9c697d17b7ec15908952ea7b84cc42760ca85dcc56fa2c6cea972fcbba59b4d6b0476094916dae699e3d728984133220f11

Download Submit
/data/data/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
483KB

MD5
f5c6afc2a23dcac894a089599272465d

SHA1
28b389e3251b2b67e7f5f13601b65422f8f56711

SHA256
f7dc169d8656cc32cb9579ee2e6ebeabad85bff5f5787c7015b67106e57aa05a

SHA512
410aeb6ab2ab0a8b65db0ba6a8ca94d33cc9c3fac6a1b5fb46f56d6605bf8f5235a7bce2e0f53ae48464f5e91c49dbf54a15cac81da424c754994659edc1ecc1

Download Submit
/data/user/0/com.top.omit/app_DynamicOptDex/dmW.json

Filesize
1.2MB

MD5
0e6e8f70702bceb278745e19c2ac2b14

SHA1
e6ea5dba97c3c1851882e120d13e43460385de01

SHA256
9e1417946a05655869642d9c560605fb8cad248f86e276f894ab0744bd428f7a

SHA512
13382ce1800d5a658a159c07c81afa5cd595db812e265d218272b26e6822f1d5975c9bfa8212d6dc11e42c406bf2bca35729eb2d18415b820fd5b7cf12179c3c

Download Submit