The ChimeraWire trojan boosts website popularity by skillfully pretending to be human
Source AlienVault OTX General
Description
Doctor Web experts have discovered a unique malware called Trojan.ChimeraWire targeting Windows computers. This trojan simulates user actions to artificially boost website rankings in search engine results. It uses the Google Chrome browser in debug mode and employs various techniques to avoid detection. The malware is distributed through multiple infection chains involving different downloaders and exploits. ChimeraWire's functionality includes automated CAPTCHA solving and simulating user clicks on websites. While currently focused on simple clicker tasks, the trojan's underlying tools have potential for more advanced malicious activities, such as form filling, web scraping, and cyber espionage. The researchers expect future versions of ChimeraWire to implement these additional features.
Indicators of compromise
Domains 10
- openthecahe.com
- temp-xy.com
- 30.openthecahe.com
- down.temp-xy.com
- git.temp-xy.com
- logs.temp-xy.com
- test.temp-xy.com
- time.temp-xy.com
- www.openthecahe.com
- down.temp-xy.com
URLs 7
- https://down.temp-xy.com/code/k.txt9421dec904e6d8c12dc2fce3df353541a721cb69e2b27055928ac6c9f10cc47f
- https://down.temp-xy.com/code/s.txt28c21c3421215b7cd9c741f795aa30cc1be6bb07bbcd65e3e1e8adda6691ffe6
- https://down.temp-xy.com/update/onedrive.zip
- https://down.temp-xy.com/update/onedrivetwo.zip
- https://down.temp-xy.com/update/python3.zip
- https://down.temp-xy.com/zip/one.zip
- https://down.temp-xy.com/zip/two.zip
IP addresses 2
- 79.110.49.212CC=TR ASN=AS209371 private network
- 91.200.14.14CC=UA ASN=ASNone
Hashes 68
- MD5 of 1e010f4637284da7c2c6ac9a8fb2b1bdec8f2abf
- MD5 of a5207352be07557960240014ebbc6401c31110c1
- MD5 of ce591bd31bee720dd0ee631f7be63904255a664b
- MD5 of 993fc928f3f3a4bd6f356d2c567548dcedeef89b
- MD5 of 370e410383244c9f1ff75acb4d0dfbef29b483f6
- MD5 of 477902f5b2934086def7319fc40662d3e603616b
- MD5 of 054b9e9a9b76eccbce00e8f4d249a8e93f178f3c
- MD5 of 7332fdb6e9b34e1d3dfb94a53272d1b3b6415333
- MD5 of d56f4ee28e2545b087972b86507843c6a7836b6d
- MD5 of e70a41a6ac176e0173f3769de127c704fb0d3239