Skip to main content
MalwarePublished Updated

The ChimeraWire trojan boosts website popularity by skillfully pretending to be human

Source AlienVault OTX General

0

Description

Doctor Web experts have discovered a unique malware called Trojan.ChimeraWire targeting Windows computers. This trojan simulates user actions to artificially boost website rankings in search engine results. It uses the Google Chrome browser in debug mode and employs various techniques to avoid detection. The malware is distributed through multiple infection chains involving different downloaders and exploits. ChimeraWire's functionality includes automated CAPTCHA solving and simulating user clicks on websites. While currently focused on simple clicker tasks, the trojan's underlying tools have potential for more advanced malicious activities, such as form filling, web scraping, and cyber espionage. The researchers expect future versions of ChimeraWire to implement these additional features.

Indicators of compromise

Domains 10

  • openthecahe.com
  • temp-xy.com
  • 30.openthecahe.com
  • down.temp-xy.com
  • git.temp-xy.com
  • logs.temp-xy.com
  • test.temp-xy.com
  • time.temp-xy.com
  • www.openthecahe.com
  • down.temp-xy.com

URLs 7

  • https://down.temp-xy.com/code/k.txt9421dec904e6d8c12dc2fce3df353541a721cb69e2b27055928ac6c9f10cc47f
  • https://down.temp-xy.com/code/s.txt28c21c3421215b7cd9c741f795aa30cc1be6bb07bbcd65e3e1e8adda6691ffe6
  • https://down.temp-xy.com/update/onedrive.zip
  • https://down.temp-xy.com/update/onedrivetwo.zip
  • https://down.temp-xy.com/update/python3.zip
  • https://down.temp-xy.com/zip/one.zip
  • https://down.temp-xy.com/zip/two.zip

IP addresses 2

  • 79.110.49.212CC=TR ASN=AS209371 private network
  • 91.200.14.14CC=UA ASN=ASNone

Hashes 68

  • 09c26df025752b9ed6c3df1ed64717eeMD5 of 1e010f4637284da7c2c6ac9a8fb2b1bdec8f2abf
  • 121883112007967088d3fcb5f5106d6bMD5 of a5207352be07557960240014ebbc6401c31110c1
  • 24a5f9ed11c73f3fee3274fc8ef55814MD5 of ce591bd31bee720dd0ee631f7be63904255a664b
  • 25f191ca42ad3d9844e0e6b7422420dbMD5 of 993fc928f3f3a4bd6f356d2c567548dcedeef89b
  • 28eeaa26cec3a45fbf997bceac93ad41MD5 of 370e410383244c9f1ff75acb4d0dfbef29b483f6
  • 2a53b01b30141ee1ab32ce31f75ee822MD5 of 477902f5b2934086def7319fc40662d3e603616b
  • 495f4aab3761c439b407b73a0ccc5b74MD5 of 054b9e9a9b76eccbce00e8f4d249a8e93f178f3c
  • 4c6051058ab1d22451daf768dcaeea29MD5 of 7332fdb6e9b34e1d3dfb94a53272d1b3b6415333
  • 5d3993838844308fd1979c90d3ccc1bdMD5 of d56f4ee28e2545b087972b86507843c6a7836b6d
  • 6eac03ff0fca651e030d8e03b8dc14eaMD5 of e70a41a6ac176e0173f3769de127c704fb0d3239

Community reviews

Loading reviews…