chameleon | d4d958c87e338fd81b710c9b495224ec1751c7e847034c7a24978483e4267fa0

Analysis

max time kernel
3s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
29/12/2024, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4d958c87e338fd81b710c9b495224ec1751c7e847034c7a24978483e4267fa0.apk
Size

3.2MB
MD5

5f8b7be295fcf4a727e0083a7e0a4712
SHA1

2653402b00c0f1d848634240388e0d7c3f91e1dc
SHA256

d4d958c87e338fd81b710c9b495224ec1751c7e847034c7a24978483e4267fa0
SHA512

a6c4a460dbab8bd8e190986023b2864ca2fd559d0bfc25db382c741200f480724e9f35c9f3e83bb6b79aa54adf78eb1b38c4c77edc1ad8e76a9128427b7a7220
SSDEEP

98304:FTbk/xl2nGHCSNi+hjEkQ3DHdXHcNcAFU12SbpsN8jt74FVV4U:BbyxonGiwbSt2mMV4U

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral1/memory/4245-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.notable.hidden/app_DynamicOptDex/XqIxQeT.json	4245	com.notable.hidden

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.notable.hidden

com.notable.hidden
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4245
- sh
  2⤵
  PID:4274
- - /system/bin/sh /system/bin/pm list package -3
    3⤵
    PID:4291
  - - cmd package list package -3
      4⤵
      PID:4307
- sh
  2⤵
  PID:4330
- - cat /proc/self/cgroup
    3⤵
    PID:4346

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact