chimera

General

Target

Myau-240105-cracked (1).jar
Size

1.6MB
Sample

240221-cdsl5saa36
MD5

9115e3db16b63fb1a254f3bd57ad5893
SHA1

9c32dfffb1582ad8df15f4464b0a246d81b06f48
SHA256

e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a
SHA512

9b6481c30f5a58cdfca9d1702e059a46dfcdcb5773f1f6ef7d324050f287bd503159f316e7b0cedc2fe396326fd9e57685627c8257f4248e5057c0bbac78f77d
SSDEEP

24576:V96G/x8Z/QUTbjvgizYcftFdGmDAhQW3ZV2gDSGuGqZBXOYS8flT6lqYI:V9xxOBPrgGfDfDAKW3ZV2FLbZBeNYB

Score

10^/10

Malware Config

Targets

- Target
  
  Myau-240105-cracked (1).jar
- Size
  
  1.6MB
- MD5
  
  9115e3db16b63fb1a254f3bd57ad5893
- SHA1
  
  9c32dfffb1582ad8df15f4464b0a246d81b06f48
- SHA256
  
  e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a
- SHA512
  
  9b6481c30f5a58cdfca9d1702e059a46dfcdcb5773f1f6ef7d324050f287bd503159f316e7b0cedc2fe396326fd9e57685627c8257f4248e5057c0bbac78f77d
- SSDEEP
  
  24576:V96G/x8Z/QUTbjvgizYcftFdGmDAhQW3ZV2gDSGuGqZBXOYS8flT6lqYI:V9xxOBPrgGfDfDAKW3ZV2FLbZBeNYB
Score

10^/10

chimera darkcomet discovery evasion persistence ransomware rat spyware stealer trojan
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera Ransomware Loader DLL
  Drops/unpacks executable file which resembles Chimera's Loader.dll.
  ransomware
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Renames multiple (3381) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1