chameleon | e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73

Analysis

max time kernel
6s
max time network
83s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
29/11/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73.apk
Size

3.1MB
MD5

ac9bada8f5e415f7a42d3783d33fff78
SHA1

f5602c1c58e80adbc31b0b6cf2aaf08400fa2573
SHA256

e32218193a0649dcb9333187c2e9b1981b923e46be3c5d09bb4290e7c976db73
SHA512

1f9763cea1e72b7876babb37612b7c9be6a47962d88a24c7094f518e82f6206ff7bf1799bfb835f6181fadb53adb4e9317c7e2b2b5d5b4b3350d240766889dc2
SSDEEP

98304:BAZkFXAySCFNSXNEk/mWmEFqSgEWkM/W+DL8CWVQzNepQc7e:BFZuC3S3iee

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral4/memory/4343-0.dex	family_chameleon

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.hardware	com.over.initial

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.over.initial/app_DynamicOptDex/gjlPlJ.json	4343	com.over.initial

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.over.initial

com.over.initial
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4343
- sh
  2⤵
  PID:4373
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4391
  - - cmd package list package -3
      4⤵
      PID:4408
- sh
  2⤵
  PID:4429
- - cat /proc/self/cgroup
    3⤵
    PID:4446

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact