chameleon | 8a07533d8b06050c8f00a33dceec100ca47183d10f938ac8e0d3bf61ba41b825

Analysis

max time kernel
4s
max time network
158s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/12/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a07533d8b06050c8f00a33dceec100ca47183d10f938ac8e0d3bf61ba41b825.apk
Size

4.1MB
MD5

160a9678fe5f938beefbeef3b664c98e
SHA1

b93d5718a5232562fbe1d147c2b866732bdc16a6
SHA256

8a07533d8b06050c8f00a33dceec100ca47183d10f938ac8e0d3bf61ba41b825
SHA512

9ead6dd1949afd5c383a9578cb2dc5549f63bc5a0b0b98e9d274dda345e60a2cb96005d8a99c0171439a7754a47bb5d9718f4248a764856a1f4766059aca8c7c
SSDEEP

98304:Fu2zoPJIPtSfIbtlNvbxZPlm7VaJDa046:FuKNXvRwVODL5

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4299-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.copper.ordinary/app_DynamicOptDex/XErFFbn.json	4299	com.copper.ordinary

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.copper.ordinary

com.copper.ordinary
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4299
- sh
  2⤵
  PID:4364
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4381
  - - cmd package list package -3
      4⤵
      PID:4397
- sh
  2⤵
  PID:4419
- - cat /proc/self/cgroup
    3⤵
    PID:4436

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact