chameleon | e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73

Analysis

max time kernel
5s
max time network
96s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
29/11/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73.apk
Size

3.1MB
MD5

ac9bada8f5e415f7a42d3783d33fff78
SHA1

f5602c1c58e80adbc31b0b6cf2aaf08400fa2573
SHA256

e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73
SHA512

1f9763cea1e72b7876babb37612b7c9be6a47962d88a24c7094f518e82f6206ff7bf1799bfb835f6181fadb53adb4e9317c7e2b2b5d5b4b3350d240766889dc2
SSDEEP

98304:BAZkFXAySCFNSXNEk/mWmEFqSgEWkM/W+DL8CWVQzNepQc7e:BFZuC3S3iee

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/5080-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.over.initial/app_DynamicOptDex/gjlPlJ.json	5080	com.over.initial

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.over.initial

com.over.initial
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5080

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact