chameleon | d52ee13dce622c4a50ec560f8076c06a617299d7d1200621c59c93c03573a0f7

Analysis

max time kernel
2s
max time network
158s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
02/02/2025, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d52ee13dce622c4a50ec560f8076c06a617299d7d1200621c59c93c03573a0f7.apk
Size

3.1MB
MD5

6d9a4d968e9976511075bf85cf70a27e
SHA1

f5be6c82c2d2523dac22c8c9d7b9fc62b66b59f4
SHA256

d52ee13dce622c4a50ec560f8076c06a617299d7d1200621c59c93c03573a0f7
SHA512

04cd1e1fd839b85448555eefd1dcd30cb095daf70104571f780ce8bb7bed0e8754b3a82433230b8d2f8bd792a7f1f9e913a092c1b3c21595c84bd8ec5ca914f6
SSDEEP

98304:PJigB3CtahhaNmXZEzqrMoXNR45unnzHEFqSgHWkG/WObLXQWmpIc8x:8A34mIuwknhkx

Score

10^/10

chameleon banker defense_evasion evasion impact infostealer trojan

Malware Config

Signatures

Chameleon
Chameleon is an Android banking trojan first seen in 2023.
trojan infostealer banker chameleon
Chameleon family
chameleon

Chameleon payload 1 IoCs

resource	yara_rule
behavioral3/memory/4801-0.dex	family_chameleon

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.fiscal.public
/system/bin/su	com.fiscal.public

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.hardware	com.fiscal.public

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fiscal.public/app_DynamicOptDex/Loo.json	4801	com.fiscal.public

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fiscal.public

com.fiscal.public
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4801

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact