chimera

General

Target

BootstrapperNew.exe
Size

3.4MB
Sample

250416-t3c2estsds
MD5

07b2ed9af56f55a999156738b17848df
SHA1

960e507c0ef860080b573c4e11a76328c8831d08
SHA256

73427b83bd00a8745e5182d2cdb3727e654ae9af5e42befc45903027f6606597
SHA512

3a982d1130b41e6c01943eee7fa546c3da95360afdad03bff434b9211201c80f22bd8bf79d065180010bc0659ee1e71febbfd750320d95811ee26a54ee1b34c6
SSDEEP

98304:HZXfHaFoQyDIvqkqXf0FglY1XOe97vLn:RaBqkSIglY1XOCnn

Score

10^/10

Malware Config

Targets

- Target
  
  BootstrapperNew.exe
- Size
  
  3.4MB
- MD5
  
  07b2ed9af56f55a999156738b17848df
- SHA1
  
  960e507c0ef860080b573c4e11a76328c8831d08
- SHA256
  
  73427b83bd00a8745e5182d2cdb3727e654ae9af5e42befc45903027f6606597
- SHA512
  
  3a982d1130b41e6c01943eee7fa546c3da95360afdad03bff434b9211201c80f22bd8bf79d065180010bc0659ee1e71febbfd750320d95811ee26a54ee1b34c6
- SSDEEP
  
  98304:HZXfHaFoQyDIvqkqXf0FglY1XOe97vLn:RaBqkSIglY1XOCnn
Score

10^/10

chimera revengerat warzonerat agilenet aspackv2 defense_evasion discovery execution infostealer persistence ransomware rat rezer0 spyware stealer themida trojan
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera family
  chimera
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Revengerat family
  revengerat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Renames multiple (3295) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- RevengeRat Executable
  stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1