chameleon | 2c2a6717a0a5239c7d2dfe5854ba0b3622610cc1a99dd718363d10efaa6ada35

Analysis

max time kernel
10s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07/11/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c2a6717a0a5239c7d2dfe5854ba0b3622610cc1a99dd718363d10efaa6ada35.apk
Size

3.6MB
MD5

b1d2bbc7ad3a97384bc054b782da711e
SHA1

fe9c448f9dcf320cd6a594ae14226e010082bf3c
SHA256

2c2a6717a0a5239c7d2dfe5854ba0b3622610cc1a99dd718363d10efaa6ada35
SHA512

e0289a396c00b774b0460bc74a9c1d01f64ffffe7beb66619732f488adbfc997bb2eb999efc8ce74e33a1bf28cd3a929b921f332fd9927c349b22c2e7ffafeb9
SSDEEP

98304:pwYQI3t8FxEqIjGHy2Nw8nJjEsQ7zHtXfIN8cZgNSiPpzItxhJaUrVKjA:pQW8FxELjGS0w6WNSfhJejA

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4345-0.dex	family_chameleon

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.hardware	com.tray.nominee

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tray.nominee/app_DynamicOptDex/ufBip.json	4345	com.tray.nominee

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tray.nominee

com.tray.nominee
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4345
- sh
  2⤵
  PID:4380
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4398
  - - cmd package list package -3
      4⤵
      PID:4415
- sh
  2⤵
  PID:4436
- - cat /proc/self/cgroup
    3⤵
    PID:4455

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact