chameleon | fd1b0532fec81fad059021788442edd7f6fcd413065346c8d717846fd2a741be

Analysis

max time kernel
7s
max time network
176s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
05/08/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd1b0532fec81fad059021788442edd7f6fcd413065346c8d717846fd2a741be.apk
Size

3.5MB
MD5

9a8d945c377893429358bc84ed08d14d
SHA1

a53c625185caeadaa13773911675693ec6101ecf
SHA256

fd1b0532fec81fad059021788442edd7f6fcd413065346c8d717846fd2a741be
SHA512

b2406d89ff9b566229424a8b5754457ffdb515b9ba4dfbcbd5b4650bfd5c7030c7144cb25a41325237bf59174c243fe43c148459a2b1ce3bcef0303efe39e489
SSDEEP

49152:jO+P5fN8LAePqiZh1FXxnzXcBWFNHAbTvkQn9jx/eBC7zupmENEwGgveCwk54FWR:bN88KbHMUAbTvkGjdew7Cpk2DwkqIR

Score

10^/10

chameleon banker evasion infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4291-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85/app_entire/kTWpp.json	4291	zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85

zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85
1⤵
- Loads dropped Dex/Jar
PID:4291

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85/app_entire/kTWpp.json

Filesize
981KB

MD5
6fd7efa940622b6bc637205a77417cbc

SHA1
4dc3cbdc80ec9a13dc3506e613eb5040e871b675

SHA256
5682a35d86b6e37cb494805fb9f401e676fa2f0f83ddd1a3d2d366d50920f0cc

SHA512
55b8a22d21ce586648b8bb00b1c03db2d03ef59b877d20aa5ca3637a25c1f43287420bcaa477b3ee6d101ec5d91730838f9f6611d0fe26047ecd2bce033d2100

Download Submit
/data/data/zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85/app_entire/kTWpp.json

Filesize
981KB

MD5
e5775a1b3623caa1a21d7fec7bc25492

SHA1
6da0ea6db7493997097e003f8ba7d7ef5ff4f7e4

SHA256
41961574c89b4d67bd39577630657b37d062cd9f0f3b9a13249df9d44732c8e4

SHA512
1ec15f7da9dce2fc093240b2886c0491a0f185838dea9dec66f2959b1d17e59b1b58a2f8ddd05795c2b5f084166be27b1294eecaf3539bae1607428c3adb5fc1

Download Submit
/data/user/0/zHZxuCtDf44a1ce51ffa0.zHZxuCtDf9303bc0b8e85/app_entire/kTWpp.json

Filesize
2.8MB

MD5
3a9236827c8ac2357f8c20f797eea961

SHA1
d5cb9e19652fb919574c3e5327828e8db0363f43

SHA256
4ad6e18150bb31b89e27535046d5d8e21a41486a3f4380de86d8dcbb3a4806a8

SHA512
c932dcc5b295ecbc76918c8bd1d87bf440232fa7b0ad279825cf514662ab89248360e7605f8df53dd902747c601171de6b881678c1d7fda28c03a484e4924b20

Download Submit