General
- Target HawkEye.exe
- Size 232KB
- Sample260712-phq1bsbx4v
- SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
Score
10/10
Malware Config
Targets
-
- Target HawkEye.exe
- Size 232KB
- SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
Score10/10Chimera Ransomware Loader DLL
Drops/unpacks executable file which resembles Chimera's Loader.dll.
Family: Chimera
Ransomware which infects local and network files, often distributed via Dropbox links.
Renames multiple (3502) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1