Overview

overview

10

Static

static

1

bipecdki.jpg

windows10-1703-x64

4

bipecdki.jpg

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bipecdki.jpg

  • Size

    183KB

  • Sample

    240905-j4kgsawdmj

  • MD5

    ef16ee90b57cac3eac93811f5e419274

  • SHA1

    50bbd97e169875d7b5a5a6b74972e5d6f505e4aa

  • SHA256

    97f3aabf9445d243dccfe0a8e0662d279e2d77f0ad88e75ec44496af748e6eea

  • SHA512

    4186aa8b555e7bbe0c64b1b1353760356f260fee47e1e377e7f1958f5e02d47e20a6641189e85f725a3d2f145855c14df4a31da12156dca00a608c543682e5d9

  • SSDEEP

    3072:9a5BgRtc2wC5sh7oQ260QkY9KNuraPk2Ziig7tmDL00ksXLpukZ/KEqSEfYKI:9sgRtc2Ky+jlijdLxnKYf

Score
10/10
chimeradefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      bipecdki.jpg

    • Size

      183KB

    • MD5

      ef16ee90b57cac3eac93811f5e419274

    • SHA1

      50bbd97e169875d7b5a5a6b74972e5d6f505e4aa

    • SHA256

      97f3aabf9445d243dccfe0a8e0662d279e2d77f0ad88e75ec44496af748e6eea

    • SHA512

      4186aa8b555e7bbe0c64b1b1353760356f260fee47e1e377e7f1958f5e02d47e20a6641189e85f725a3d2f145855c14df4a31da12156dca00a608c543682e5d9

    • SSDEEP

      3072:9a5BgRtc2wC5sh7oQ260QkY9KNuraPk2Ziig7tmDL00ksXLpukZ/KEqSEfYKI:9sgRtc2Ky+jlijdLxnKYf

    Score
    10/10
    chimeradefense_evasiondiscoveryransomwarespywarestealer

    • Chimera

      Ransomware which infects local and network files, often distributed via Dropbox links.

      ransomwarechimera

    • Chimera Ransomware Loader DLL

      Drops/unpacks executable file which resembles Chimera's Loader.dll.

      ransomware

    • Renames multiple (3302) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks