Resubmissions

11-03-2024 15:52

240311-ta6s2aeg21 3

11-03-2024 15:51

240311-tak7bsag28 3

11-03-2024 15:43

240311-s5yv8sae92 10

11-03-2024 15:38

240311-s3gtyaed71 7

11-03-2024 15:35

240311-s1j7aaed21 10

11-03-2024 15:25

240311-stsj3sab93 10

General

  • Target

    Nitr0-G3n3rat0r.exe

  • Size

    23.8MB

  • Sample

    240311-s1j7aaed21

  • MD5

    f04a56628a19894bd9c0403757656f79

  • SHA1

    1c4d8f4c61297d9128c5922b097c9a1619dea695

  • SHA256

    5698d21c2b45070e70349fd8c7358afcab0d36fdd5bac0a1f8174a1dd6d311b2

  • SHA512

    8f03e5b400d54a7569eaa6fffb408692cd35bdb498ce0b735cd4b49d6abcebed90e61c9246987abafbd30124b417db54f2f8fd93ed1b602b5ffb14944a824685

  • SSDEEP

    393216:WuLrpBgQTSBfFZNRwSo6oDfDg4c6AHZgOGF3hi:r5BgQeBfFXR66ob03pZr63

Malware Config

Targets

    • Target

      Nitr0-G3n3rat0r.exe

    • Size

      23.8MB

    • MD5

      f04a56628a19894bd9c0403757656f79

    • SHA1

      1c4d8f4c61297d9128c5922b097c9a1619dea695

    • SHA256

      5698d21c2b45070e70349fd8c7358afcab0d36fdd5bac0a1f8174a1dd6d311b2

    • SHA512

      8f03e5b400d54a7569eaa6fffb408692cd35bdb498ce0b735cd4b49d6abcebed90e61c9246987abafbd30124b417db54f2f8fd93ed1b602b5ffb14944a824685

    • SSDEEP

      393216:WuLrpBgQTSBfFZNRwSo6oDfDg4c6AHZgOGF3hi:r5BgQeBfFXR66ob03pZr63

    Score
    10/10
    • Chimera

      Ransomware which infects local and network files, often distributed via Dropbox links.

    • Chimera Ransomware Loader DLL

      Drops/unpacks executable file which resembles Chimera's Loader.dll.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks