Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://cdn.discordapp.com/attachments/1489692751346925569/1519285129636479016/dih.exe?ex=6a3e5189&is=6a3d0009&hm=21aa5d7e0087d1e721a2886a4ec04cb9d76f9829c86ad07faa5b0e5c26015e7c&
  • Sample260625-vcpszadv5y
Score
10/10
chimeraadwarediscoveryinstallerpersistenceransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\dih.exe

Ransom Note
  • { "name": "project_1", "config": { "general": { "project_name": "dih", "version": "1.0", "author": "$$BLACKNET-00$$", "description": "67", "output_format": "exe", "icon_file": "", "digital_signature": false, "stealth_mode": true }, "ransom_note": { "title": "$$BLACKNET-00$$ ENCRYPTOR", "bitcoin_address": "13TSahvLK6EGene38RQWzfUfQKkpqtRoL6", "bitcoin_qr": "C:\\Users\\Danny\\AppData\\Local\\Temp\\bitcoin_qr.png", "email": "[email protected]", "password": "BLACKNET2000", "amount": 500, "currency": "USD", "deadline": 72, "message": "YOUR FILES HAVE BEEN ENCRYPTED!\n\nAll your personal files (documents, photos, videos, databases) are locked with military-grade encryption.\n\n================================================\n PAYMENT REQUIRED FOR DECRYPTION\n================================================\n\nTo decrypt your files, send {amount} {currency} in Bitcoin to:\n{bitcoin}\n\nAfter payment, contact us at:\n{email}\n\nYou will receive:\n- Decryption password\n- Recovery tool\n- Decryption instructions\n\nWARNING: DO NOT ATTEMPT TO DECRYPT FILES YOURSELF\nWARNING: DO NOT USE ANTIVIRUS OR RECOVERY TOOLS\nWARNING: FILES WILL BE PERMANENTLY DELETED AFTER {deadline} HOURS\n\nTime remaining: {deadline} hours\n\n================================================\n $$BLACKNET-00$$ RANSOMWARE\n================================================", "html_note": true, "audio_alert": true, "countdown_alert": true, "show_bitcoin_qr": true, "multiple_languages": false }, "encryption": { "method": "AES-256", "key_size": 256, "extension": ".blacknet", "delete_originals": true, "hide_files": true, "parallel_threads": 8, "encrypt_filenames": true, "scramble_names": true, "multi_pass": false, "passes": 3, "memory_only": false, "key_protection": true, "decryptor_builtin": true }, "targets": { "all_files": false, "documents": true, "photos": true, "videos": true, "music": true, "databases": true, "archives": true, "emails": true, "backups": true, "virtual_machines": true, "source_code": true, "crypto_wallets": true, "extensions": [ ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".pdf", ".txt", ".rtf", ".odt", ".ods", ".odp", ".jpg", ".jpeg", ".png", ".bmp", ".gif", ".tiff", ".mp3", ".mp4", ".avi", ".mkv", ".mov", ".wmv", ".zip", ".rar", ".7z", ".tar", ".gz", ".bz2", ".sql", ".mdb", ".accdb", ".sqlite", ".db", ".php", ".html", ".js", ".py", ".java", ".c", ".cpp", ".key", ".pem", ".p12", ".pfx", ".crt", ".bak", ".backup", ".old", ".copy", ".vmdk", ".vdi", ".psd", ".ai", ".cdr", ".dwg", ".dxf", ".wallet", ".eml", ".msg", ".pst", ".ost", ".conf", ".config" ], "directories": [ "C:\\Users\\", "D:\\", "E:\\", "F:\\", "G:\\" ], "exclude_dirs": [ "C:\\Windows", "C:\\Program Files", "C:\\Program Files (x86)", "C:\\ProgramData", "C:\\$Recycle.Bin", "C:\\System Volume Information" ], "min_size": 0, "max_size": 100000000, "follow_shortcuts": true, "network_drives": true, "removable_drives": true, "cloud_storage": true }, "system_locks": { "disable_defender": true, "disable_taskmgr": true, "disable_regedit": true, "disable_cmd": true, "disable_powershell": true, "disable_run": true, "disable_control_panel": true, "disable_context_menu": true, "disable_safe_mode": true, "disable_recovery": true, "disable_windows_update": true, "disable_system_restore": true, "disable_firewall": true, "block_task_keys": true, "block_alt_f4": true, "block_ctrl_alt_del": true, "kill_processes": true, "kill_list": [ "taskmgr.exe", "procexp.exe", "processhacker.exe", "perfmon.exe", "resmon.exe", "cmd.exe", "powershell.exe", "wireshark.exe", "procmon.exe", "regedit.exe", "msconfig.exe", "chrome.exe", "firefox.exe", "msedge.exe", "skype.exe" ] }, "behavior": { "hide_window": true, "run_as_admin": true, "bypass_uac": true, "bypass_applocker": true, "melt_file": true, "wait_time": 0, "spread_usb": true, "autorun_inf": true, "copy_to_usb": true, "network_spread": true, "network_scan": true, "exploit_eternalblue": false, "ransomware_notes": true, "multiple_notes": true, "wallpaper_change": true, "desktop_notes": true, "popup_messages": true, "audio_alerts": true }, "persistence": { "enable": true, "startup_folder": true, "registry_run": true, "scheduled_task": true, "service_install": false, "dll_hijacking": false, "process_injection": true, "injection_target": "explorer.exe", "multiple_methods": true, "watchdog": true }, "wallpaper": { "change": true, "custom_image": "", "background_color": "#000000", "text_color": "#ff0000", "secondary_color": "#00ff00", "show_count": true, "show_timer": true, "show_bitcoin": true, "show_email": true, "show_amount": true, "animated": false, "blink_effect": true, "glitch_effect": true }, "network": { "c2_server": "", "c2_port": 443, "callback_url": "", "callback_interval": 3600, "send_keys": false, "send_screenshot": false, "send_filelist": true, "download_payload": "", "use_ssl": true, "tor_proxy": false, "i2p_network": false, "dga_domain": false, "fallback_c2": "" }, "evasion": { "obfuscation": true, "obfuscation_level": "high", "pack_with_upx": true, "upx_level": 9, "anti_debug": true, "anti_vm": true, "vm_list": [ "vmware", "vbox", "qemu", "xen", "virtualbox" ], "sandbox_detection": true, "time_bomb": false, "bomb_date": "", "self_destruct": false, "destruct_after": 0, "encrypt_self": false, "polymorphic": false, "metamorphic": false, "armor_protect": true, "steganography": false, "split_files": false, "fake_error": true, "fake_installer": true }, "ransom_options": { "type": "crypto", "leak_data": false, "leak_site": "", "double_extortion": false, "auction_data": false, "negotiation": false, "live_chat": false, "tor_site": "", "payment_methods": [ "bitcoin" ], "discount_deadline": 24, "discount_percent": 50, "company_name": "", "company_data": "", "press_release": false }, "advanced_features": { "keylogger": false, "screenshots": false, "webcam_capture": false, "audio_recording": false, "password_stealer": false, "browser_stealer": true, "wallet_stealer": true, "ftp_stealer": true, "email_stealer": true, "vpn_stealer": true, "messenger_stealer": true, "file_uploader": false, "remote_access": false, "reverse_shell": false, "proxy_server": false }, "statistics": { "track_success": true, "send_stats": true, "stats_url": "", "unique_id": "e06e1eb1c2a96199", "campaign_name": "default", "victim_count": 1, "total_earned": 0, "success_rate": 0 } }, "timestamp": "2026-06-23T19:25:46.395389" }

Targets

    • Target
      https://cdn.discordapp.com/attachments/1489692751346925569/1519285129636479016/dih.exe?ex=6a3e5189&is=6a3d0009&hm=21aa5d7e0087d1e721a2886a4ec04cb9d76f9829c86ad07faa5b0e5c26015e7c&
    Score
    10/10
    adwarediscoverychimerainstallerpersistenceransomwarespyware

    • Chimera Ransomware Loader DLL

      Drops/unpacks executable file which resembles Chimera's Loader.dll.

      ransomware

    • Family: Chimera

      Ransomware which infects local and network files, often distributed via Dropbox links.

      ransomwarechimera

    • Renames multiple (3523) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks