chimera

General

Target

RNSM00465.7z
Size

22.9MB
Sample

241007-y5hf5ssfnm
MD5

d565dedc4e69f09e4c6af080b5abd80e
SHA1

07f520b14da34c3ff9d10fcf914b587617600831
SHA256

5f5b9a128c1edbcc32df898fbeb4b49740c3c3508aae3e3168a1c78d57f8b616
SHA512

2cfb9fa69be795841df0f2a02056a24e6f8cbbeca302c3279460044afc12e9a0f27f94d1035504bb5d4285cda65232698a5dcbece871caef23ead2be876e5d8f
SSDEEP

393216:si92YBqRzfashchMEfjT0f77sShjDKXZRQbZyfe3fNo8NtbqTuo6DTEmBvYSWdgH:s0qRb9hchmf77/yZRQkfevNo8NMTQQmn

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

165d6ed988ac1dbec1627a1ca9899d84

Attributes

reg_key
165d6ed988ac1dbec1627a1ca9899d84
splitter
|'|'|

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\HOW-TO-DECRYPT.TXT

Ransom Note

Ooops! All your important files are encrypted! [+] What happend to my computer? [+] All your important files are encrypted. No one can help you to restore files without our special decryptor. Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $250. [+] How do i pay? [+] Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom. [+] How can i contact? [+] 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) [+] What if i already paid? [+] Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software. 3.Do not turn off your computer. Our bitcoin address: bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe

Emails

[email protected]

URLs

http://mail2tor2zyjdctd.onion/

Extracted

Path

C:\Program Files\Common Files\DESIGNER\YOUR_FILES_ARE_ENCRYPTED.HTML

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset='utf-8'> <meta name='viewport' content='width=device-width,initial-scale=1'> <title></title> <style> html, body { background-color: #1a1a1a; } body { padding-top: 1rem !important; font-size: 1.3rem; color: white; } #text h2 { font-size: 2rem; font-weight: 600; line-height: 1.125; } .container { max-width: 1152px; flex-grow: 1; margin: 0 auto; position: relative; width: auto; } .box { background-color: #242424; display: block; padding: 1.25rem; border: 1px solid #303030; } a { color: #00b4d8; text-decoration: none; } a:hover { text-decoration: underline; } li { margin-bottom: 10px; } </style> </head> <body> <div class='container'> <div class='box'> <div id='text'> <h2>If you get this message, your network was hacked!</h2> <p>After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them.</p> <p>That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally.</p> <p>We used modern complicated algorithms, so you or any recovery service will not be able to decrypt files without our help, wasting time on these attempts instead of negotiations can be fatal for your company.</p> <p>Make sure to act within <span style='color:#f4a261;'>72</span> hours or the negotiations will be considered failed!</p> <p>Inform your superior management about what's going on, invite someone who is authorized to solve financial issues to our private chat. To get there you should download and install <a href='https://www.torproject.org/download/'>TOR browser</a> and follow the link below:</p> <a href="http://ebwexiymbsib4rmw.onion/chat.html?88c3eadff6-7acbb439fb-ec14a6c53b-983e5c9290-98387541fe-aff6eed3e6-0fc9d06c09-a5b4d1502b">http://ebwexiymbsib4rmw.onion/chat.html?88c3eadff6-7acbb439fb-ec14a6c53b-983e5c9290-98387541fe-aff6eed3e6-0fc9d06c09-a5b4d1502b</a> <h2>If you and us succeed the negotiations we will grant you:</h2> <ul> <li>complete confidentiality, we will keep in secret any information regarding to attack, your company will act as if nothing had happened.</li> <li>comprehensive information about vulnerabilities of your network and security report.</li> <li>software and instructions to decrypt all the data that was encrypted.</li> <li>all sensitive downloaded data will be permanently deleted from our cloud storage and we will provide an erasure log.</li> </ul> <h2>Our options if you act like nothing's happening, refuse to make a deal or fail the negotiations:</h2> <ul> <li>inform the media and independent journalists about what happened to your servers. To prove it we'll publish a chunk of private data that you should have ciphered if you care about potential breaches. Moreover, your company will inevitably take decent reputational loss which is hard to assess precisely.</li> <li>inform your clients, employees, partners by phone, e-mail, sms and social networks that you haven't prevent their data leakage. You will violate laws about private data protection.</li> <li>start DDOS attack on you website and infrastructures.</li> <li>personal data stored will be put on sale on the Darknet to find anyone interested to buy useful information regarding your company. It could be data mining agencies or your market competitors.</li> <li>publish all the discovered vulnerabilities found in your network, so anyone will do anything with it.</li> </ul> <h2>Why pay us?</h2> <p>We care about our reputation. You are welcome to google our cases up and be sure that we don't have a single case of failure to provide wha we promissed.</p> <p>Turning this issue to a bug bounty will save your private information, reputation and will allow you to use the security report and avoid this kind of situations in future.</p> </div> </div> </div> </body> </html>��

Extracted

Family

djvu

C2

http://astdg.top/fhsgtsspen6/get.php

Attributes

extension
.orkf
offline_id
4aBXQVNZ4BhjpMjt78QLIFtBSJPbgbflYLHrBut1
payload_url
http://securebiz.org/dl/build2.exe

http://astdg.top/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0328gDrgo

rsa_pubkey.plain

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+qmsve.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/9AFA7123D1D3982 2. http://b4youfred5485jgsa3453f.italazudda.com/9AFA7123D1D3982 3. http://5rport45vcdef345adfkksawe.bematvocal.at/9AFA7123D1D3982 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/9AFA7123D1D3982 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/9AFA7123D1D3982 http://b4youfred5485jgsa3453f.italazudda.com/9AFA7123D1D3982 http://5rport45vcdef345adfkksawe.bematvocal.at/9AFA7123D1D3982 *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/9AFA7123D1D3982 *-*-* Your personal identification ID: 9AFA7123D1D3982

URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/9AFA7123D1D3982

http://b4youfred5485jgsa3453f.italazudda.com/9AFA7123D1D3982

http://5rport45vcdef345adfkksawe.bematvocal.at/9AFA7123D1D3982

http://fwgrhsao3aoml7ej.onion/9AFA7123D1D3982

http://fwgrhsao3aoml7ej.ONION/9AFA7123D1D3982

Targets

- Target
  
  RNSM00465.7z
- Size
  
  22.9MB
- MD5
  
  d565dedc4e69f09e4c6af080b5abd80e
- SHA1
  
  07f520b14da34c3ff9d10fcf914b587617600831
- SHA256
  
  5f5b9a128c1edbcc32df898fbeb4b49740c3c3508aae3e3168a1c78d57f8b616
- SHA512
  
  2cfb9fa69be795841df0f2a02056a24e6f8cbbeca302c3279460044afc12e9a0f27f94d1035504bb5d4285cda65232698a5dcbece871caef23ead2be876e5d8f
- SSDEEP
  
  393216:si92YBqRzfashchMEfjT0f77sShjDKXZRQbZyfe3fNo8NtbqTuo6DTEmBvYSWdgH:s0qRb9hchmf77/yZRQkfevNo8NMTQQmn
Score

10^/10

chimera djvu njrat hacked defense_evasion discovery evasion execution impact persistence privilege_escalation pyinstaller ransomware spyware stealer themida trojan upx
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies WinLogon for persistence
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Renames multiple (974) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1