Extracted

• • Target
    z7troll.exe
  • Size 3.1MB
  • SHA256 e5b3c4e5f21b7297b2f9e4ac2f0be0d9548ea9e8c729cf3624003cd8dd08f34f
  • MD5 5a269353710e9487f3731bf973412598
  • SHA1 67ea643b84b2c52e954418040c4e6a5d70680996
  • SHA512 3d10b9b057062faf5336c8f83c87b7ff2aa5152983ab519e7aaa62ac3f67ccabe05a73e5cf3e258c5335362ccae02cf67bcb7703acba6e5ae126b370a6719462
  • SSDEEP 49152:zxWRi7FAbN8a1h68S+QmfMWByT8+HE90IFTaaplWMZhSHW:ciKbZ1LHFbplTZhSHW
  • TLSH
    T1BFE5BF67A3A141E8C166D47CC6479713EE71780B072096DB6BE04F5A2FA3BE06A7F341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasiondiscoverychimeradanabotransomwarespywarestealertrojan

  • Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera

  • Chimera Ransomware Loader DLL

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware

  • Chimera family

    chimera

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Renames multiple (416) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2