chimera

Target
Myau-240105-cracked (1).jar
Size 1.6MB
Sample240221-cdsl5saa36
SHA256 e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a
MD5 9115e3db16b63fb1a254f3bd57ad5893
SHA1 9c32dfffb1582ad8df15f4464b0a246d81b06f48
SHA512 9b6481c30f5a58cdfca9d1702e059a46dfcdcb5773f1f6ef7d324050f287bd503159f316e7b0cedc2fe396326fd9e57685627c8257f4248e5057c0bbac78f77d
SSDEEP 24576:V96G/x8Z/QUTbjvgizYcftFdGmDAhQW3ZV2gDSGuGqZBXOYS8flT6lqYI:V9xxOBPrgGfDfDAKW3ZV2FLbZBeNYB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Myau-240105-cracked (1).jar
- Size 1.6MB
- SHA256 e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a
- MD5 9115e3db16b63fb1a254f3bd57ad5893
- SHA1 9c32dfffb1582ad8df15f4464b0a246d81b06f48
- SHA512 9b6481c30f5a58cdfca9d1702e059a46dfcdcb5773f1f6ef7d324050f287bd503159f316e7b0cedc2fe396326fd9e57685627c8257f4248e5057c0bbac78f77d
- SSDEEP 24576:V96G/x8Z/QUTbjvgizYcftFdGmDAhQW3ZV2gDSGuGqZBXOYS8flT6lqYI:V9xxOBPrgGfDfDAKW3ZV2FLbZBeNYB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chimera darkcomet discovery evasion persistence ransomware rat spyware stealer trojan
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera Ransomware Loader DLL
  Drops/unpacks executable file which resembles Chimera's Loader.dll.
  ransomware
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Renames multiple (3381) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1