chameleon | 6ca68720c2f35e8d1c7b525f7ab79ff10b6a4f5537561885d7e1c045b5bb7def

Analysis

max time kernel
1s
max time network
151s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
23/01/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ca68720c2f35e8d1c7b525f7ab79ff10b6a4f5537561885d7e1c045b5bb7def.apk
Size

3.7MB
MD5

dbf144d6879843ff69b0a5d00e36b6ae
SHA1

cdbdb2d804a05c737439012f5d2d99e77b1b148d
SHA256

6ca68720c2f35e8d1c7b525f7ab79ff10b6a4f5537561885d7e1c045b5bb7def
SHA512

016b72daf281f85e978fdd86fadf6cabf5d477c9974165574f22d196625e6132e9f4b21f3d251a9da26b0e726e1ba01c65833b9fc3d29cd122baf9e9ef13e49f
SSDEEP

98304:HUix3yEWRey/hKQATwSCgxNHNx9v9SuEcq2nGYNh:H13PqhODH39vaRTYf

Score

10^/10

chameleon banker defense_evasion evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral2/memory/5132-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.bottom.rule/app_DynamicOptDex/Sp.json	5132	com.bottom.rule

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bottom.rule

com.bottom.rule
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5132

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact