chimera

General

Target
R3FLX.zip
Size 738B
Sample260224-t7d5aafy2c
SHA256 0dc0bce4b8a60038dc68aa16295970335aad2228dafb8013464ced25753a0602
MD5 78a2f337c0fe3a12b7d5ca3b0d11aad4
SHA1 0b8f09174d35cc933ea9717f673d575822bc9d03
SHA512 855f086c8a8c2177905c662f927988a7bce7b3f34d19ab7eb1773602ce785c749c9162ef0656952e6960d2032d19cc83bf0a8a8dfcff9ab3c0eba79c276afbeb
TLSH
T1320165421269C25AD2832F373551891B020C86A2184D761A140D5DF3148A3CF1F65F4C
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  R3FLX.zip
- Size 738B
- SHA256 0dc0bce4b8a60038dc68aa16295970335aad2228dafb8013464ced25753a0602
- MD5 78a2f337c0fe3a12b7d5ca3b0d11aad4
- SHA1 0b8f09174d35cc933ea9717f673d575822bc9d03
- SHA512 855f086c8a8c2177905c662f927988a7bce7b3f34d19ab7eb1773602ce785c749c9162ef0656952e6960d2032d19cc83bf0a8a8dfcff9ab3c0eba79c276afbeb
- TLSH
  T1320165421269C25AD2832F373551891B020C86A2184D761A140D5DF3148A3CF1F65F4C
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery chimera floxif ransomware trojan upx
- Chimera
  Ransomware which infects local and network files, often distributed via Dropbox links.
  ransomware chimera
- Chimera Ransomware Loader DLL
  Drops/unpacks executable file which resembles Chimera's Loader.dll.
  ransomware
- Chimera family
  chimera
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Renames multiple (3477) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  R3FLX_TOOL.py
- Size 1KB
- SHA256 e9420cc5257b9a925d687f3fbde38b2300980d322693d11b5c45e2d72387f347
- MD5 c270b63d4d2a28768f868ed56cb16515
- SHA1 193ed2a5f33e18cf5539bd37e76e18ac6ca73c24
- SHA512 c350cc29322936252bc07b5fcab27de7c6a1034543ded76e8143d12cb61dd67bc9ca6459cdf2da822884e976ec6360d7b03a595cd1291c58d06e82c05137197b
- TLSH
  T1274190403C1142898371886AE58BB924BE82F46C01B72541BBBF81F9C7371C5F9334EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware stealer upx
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2