chimera

General

Target

https://sites.google.com/view/thebest1ds
Sample

240423-xwkdpsbb22

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Targets

- Target
  
  https://sites.google.com/view/thebest1ds
Score

10^/10

chimera njrat warzonerat evasion infostealer persistence ransomware rat rezer0 trojan upx
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera Ransomware Loader DLL
  Drops/unpacks executable file which resembles Chimera's Loader.dll.
  ransomware
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Renames multiple (3272) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Warzone RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1