Extracted

• • Target
    index.html
  • Size 2KB
  • SHA256 e2a146a9e16946ac2d1a0e888065c16ea9d22e3747bac5e59be81a5f9e482c08
  • MD5 0513db9a4a603188c34b934a2e83da10
  • SHA1 8ad0799cd39ff8b33e31cdbfa1a4671e74fd9a05
  • SHA512 5cd9d0b04dd21b9d09e53101f20d2f609122fda8fb1fd2f429db94bbdecce5ccdee5c94c7d376cad0ba814489261e6b22e47d8ef7d8e9284877f4622f620bc05
  • TLSH
    T13D514367869054610370813028D7F196DB65858FC32EE86279AC259D6FC2F7186B75F2
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwarebackdoorbootkitdefense_evasiondiscoveryexecutionchimeracrimsonratfloxiftroldeshinstallerpersistenceransomwareratspywarestealertrojanupx

  • Chimera Ransomware Loader DLL

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware

  • CrimsonRAT main payload

  • Family: Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera

  • Family: CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Family: Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Detects Floxif payload

    backdoor

  • Renames multiple (3463) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2