chameleon | 96c45da94f02cf836bc854f83eae5f475c51e07b5885a493f7b7180540c2dcc4

Analysis

max time kernel
6s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20/09/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c45da94f02cf836bc854f83eae5f475c51e07b5885a493f7b7180540c2dcc4.apk
Size

2.4MB
MD5

23ee0c3df1279fccd33bb0aa54f546bd
SHA1

693783b6217ead1f8cc53020bed03a52cdee5f5f
SHA256

96c45da94f02cf836bc854f83eae5f475c51e07b5885a493f7b7180540c2dcc4
SHA512

9a958f05fa18e638a3c5e7e0c00b71631e3fae353fe1bfefd89c3f36b7ca5a4cf5effdb832aaacdd803e7d96c7e5245d81bdec91038de1b47908ae90737c3ebe
SSDEEP

49152:3/yR071gsdHCansabGHGLSSw56SsF+8z4/qtK2NZjo2/Lj6XTfv:6R8iBwGHGO6SsFhz4yvA2aXTH

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4270-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ugly.sudden/app_DynamicOptDex/PPUQXKm.json	4270	com.ugly.sudden

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ugly.sudden

com.ugly.sudden
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4270
- sh
  2⤵
  PID:4307
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4325
  - - cmd package list package -3
      4⤵
      PID:4341
- sh
  2⤵
  PID:4363
- - cat /proc/self/cgroup
    3⤵
    PID:4380

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact