chameleon | 5b8d3731c7ae44f17fa56ecd4d6063a8edd2855cf3a52725bf14a5256714bf4d

Analysis

max time kernel
8s
max time network
131s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
24/01/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b8d3731c7ae44f17fa56ecd4d6063a8edd2855cf3a52725bf14a5256714bf4d.apk
Size

3.3MB
MD5

99f0ca8a5bd6c00fbad74e29a0190a27
SHA1

c2d1616c4498bfadef681ea8d053a65afde14ccc
SHA256

5b8d3731c7ae44f17fa56ecd4d6063a8edd2855cf3a52725bf14a5256714bf4d
SHA512

b8281db228967eba865bafd5e0055b09009204eadf344595c4502919b1db110d0026c51cf95c51377eb47a97dc598a1f0217a97ef9407d49e3dd934c68396618
SSDEEP

98304:brlFSEYAhQGHcCNp+f7jEpQDGHhXtVNyW2deTx9QSFbU817t0qxpQA:flQEYMQG8ApaCVTf7FpQA

Score

10^/10

chameleon banker evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral3/memory/4531-0.dex	family_chameleon

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.spice.surprise/app_DynamicOptDex/oFdeGYa.json	4531	com.spice.surprise

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.spice.surprise

com.spice.surprise
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4531

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact