Malware
malware:chamois
Large Android malware family and botnet investigated by Maddie for more than a year.
Large Android malware family and botnet investigated by Maddie for more than a year.
“what we called Chamois. It took a lot of practice to learn how to pronounce that correctly, but it was a large botnet”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Maddie Stone | Explicit | 127 |
| outgoing | USES | anti-analysis | Explicit | 127 |
| outgoing | USES | anti-debugging | Explicit | 127 |
| outgoing | USES | Java Native Interface | Explicit | 127 |
Chamois DISCOVERED_BY Maddie Stone
Maddie investigated and identified Chamois as a sophisticated malware family and botnet.
Explicit Confidence 96% · Maddie Stone EP 127 Details
“one of the biggest malware families that I was not expecting”
“it became clear that it was this botnet and this family of malware”
Chamois USES anti-analysis
Chamois performed extensive anti-analysis checks to determine whether it was being examined by a security researcher.
Explicit Confidence 99% · Maddie Stone EP 127 Details
“doing an incredible amount of anti-analysis”
Chamois USES anti-debugging
Chamois performed extensive anti-debugging checks.
Explicit Confidence 99% · Maddie Stone EP 127 Details
“as well as doing an incredible amount of anti-analysis and anti-debugging checks”
Chamois USES Java Native Interface
The malware's presentation covered Java Native Interface manipulations.
Explicit Confidence 97% · Maddie Stone EP 127 Details
“some of the JNI or Java native interface manipulations”