chameleon | 2937d2f1c634daedf63f43a032bf9326f00b09ea460222a8d2bed82562169cfe

Analysis

max time kernel
8s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
29/11/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2937d2f1c634daedf63f43a032bf9326f00b09ea460222a8d2bed82562169cfe.apk
Size

3.7MB
MD5

4f8aa1e43f3275eace7dc85920ff9fd6
SHA1

cdc7889906dff64c5fcfda178598462bd14ea108
SHA256

2937d2f1c634daedf63f43a032bf9326f00b09ea460222a8d2bed82562169cfe
SHA512

3d73715b514d93b1044928df3fd85c8eed6aa16be4b9d9b285507c269e486a791757af608e283e2596a7fdfbe4026e6c2d282c91f2245221444e9fcef424dd11
SSDEEP

98304:iZuk1j02W8WFEKNaiLrIwdMfeokDDqM5Mge:Cuk1j02AFEIaiL0iRokDDe

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4286-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.educate.path/app_DynamicOptDex/XnlJUWQ.json	4286	com.educate.path

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.educate.path

com.educate.path
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4286
- sh
  2⤵
  PID:4320
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4338
  - - cmd package list package -3
      4⤵
      PID:4354
- sh
  2⤵
  PID:4377
- - cat /proc/self/cgroup
    3⤵
    PID:4394

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact