chimera

General

Target

libcrypto-3-x64.dll
Size

4.5MB
Sample

250114-kxfqpavrdj
MD5

a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1

1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA256

03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
SHA512

97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP

98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC

Score

10^/10

Malware Config

Targets

- Target
  
  libcrypto-3-x64.dll
- Size
  
  4.5MB
- MD5
  
  a9c1f7ca15c65c139bc9d4bf57df2e1e
- SHA1
  
  1b1377139a6b289d43a6b1161cd1089ffc817cf9
- SHA256
  
  03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
- SHA512
  
  97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
- SSDEEP
  
  98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
Score

10^/10

chimera credential_access defense_evasion discovery macro macro_on_action persistence ransomware spyware stealer
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera Ransomware Loader DLL
  Drops/unpacks executable file which resembles Chimera's Loader.dll.
  ransomware
- Chimera family
  chimera
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Renames multiple (3260) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1