chameleon | 10c7bacd6e5f1fef74285335d2ae999082737335f6daecc0df0cbd497dd74453

Analysis

max time kernel
3s
max time network
136s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21/01/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10c7bacd6e5f1fef74285335d2ae999082737335f6daecc0df0cbd497dd74453.apk
Size

3.7MB
MD5

3f7856556b493e826f33e144b2a89a4e
SHA1

33df6eacecdfb0396c5e3c7a797fb0dc55e604dd
SHA256

10c7bacd6e5f1fef74285335d2ae999082737335f6daecc0df0cbd497dd74453
SHA512

6962ca686a629bf4c41677237dcfc6e8684ac2d36a7f8e1b66e68396e11bb534ed6dfef465fb59c016a5e0bf24c142ddfc4a01105d76abc6ed58936963a99f65
SSDEEP

98304:fw02VWIbXWPAZx1ZWMNJbb1G1yxuZdMiltqaF/9aYmg5P6:Y02VFx/LH5bg1yxkMilD6

Score

10^/10

chameleon banker defense_evasion evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4990-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sting.enrich/app_DynamicOptDex/Lwye.json	4990	com.sting.enrich

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sting.enrich

com.sting.enrich
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4990

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact