2b89584d93a7bae0b2d16cc1caf77e59136abcfadef46b853ca174cb4fd9606c

General

Target
Chimera_tool.zip
Size 15.1MB
Sample260905-mh85ssdc49
SHA256 2b89584d93a7bae0b2d16cc1caf77e59136abcfadef46b853ca174cb4fd9606c
MD5 f8d73d0d7ef6cafa78d8521b99284970
SHA1 30fc2a1763e129a6d34111119137c6de431a0eee
SHA512 09bb1607cb172c5e73994fb7566900247a236d49df217f900a3d65765ba634b848744e31cabbee065ee757bfca20b500baddb6d1114687dfafbbaeec9d630c9f
SSDEEP 393216:z5cQXorBW9cUxWdsY2w9u1CXWnYU/GVNk3RJXVzrjluS0Qf:zKQX799TCXWnYUuc3DXuSD
TLSH
T191F6339658F0EC780469E15F1CEA47702E2C9EBBF8ED519A7F5723CEE02567320C58A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Chimera_tool.zip
- Size 15.1MB
- SHA256 2b89584d93a7bae0b2d16cc1caf77e59136abcfadef46b853ca174cb4fd9606c
- MD5 f8d73d0d7ef6cafa78d8521b99284970
- SHA1 30fc2a1763e129a6d34111119137c6de431a0eee
- SHA512 09bb1607cb172c5e73994fb7566900247a236d49df217f900a3d65765ba634b848744e31cabbee065ee757bfca20b500baddb6d1114687dfafbbaeec9d630c9f
- SSDEEP 393216:z5cQXorBW9cUxWdsY2w9u1CXWnYU/GVNk3RJXVzrjluS0Qf:zKQX799TCXWnYUuc3DXuSD
- TLSH
  T191F6339658F0EC780469E15F1CEA47702E2C9EBBF8ED519A7F5723CEE02567320C58A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion discovery execution persistence ransomware spyware trojan upx adware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Xen via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2