Chimera is a Windows ransomware family known for targeted email-based distribution against small companies.
Profile source: Mallory opens in a new tabChimera
Chimera is a Windows ransomware family known for targeted email-based distribution against small companies. It encrypts files on available disks and appends a .crypt-style extension, then presents an HTML ransom note in English or German, including full-screen display through Internet Explorer. Chimera became notable for early use of leak-style extortion threats, claiming that stolen files and credentials would be published if payment was not made; however, examined samples indicated that this exfiltration threat was not actually implemented in those builds.
The malware has been documented as a multi-stage loader chain consisting of a packed .NET stub, an intermediate loader, and a core payload. The stub decrypts and launches the next stage using RunPE-style or manual-mapping techniques, while the core component performs host identification, encryption, ransom-note handling, and network communications. Chimera generates victim-specific identifiers from host characteristics, collects basic system information, and uses asymmetric cryptography to protect per-file symmetric encryption keys. It processes files in chunks and communicates over the Bitmessage peer-to-peer protocol rather than relying solely on conventional centralized command-and-control infrastructure.
Separately from the ransomware family, Chimera is also tracked as an intrusion set associated with enterprise post-compromise activity. That activity includes credential abuse, password-hash dumping for pass-the-hash, bookmark and email collection, network-share discovery, domain-trust discovery, network scanning, scheduled-task persistence, timestomping, HTTPS and DNS-encapsulated command-and-control, and exfiltration to attacker-controlled channels and cloud storage. Those intrusion-set behaviors should not be conflated with the original ransomware family unless specifically distinguished in analysis.
MITRE ATT&CK
Reporting
The Petya ransomware family used German-language job-application phishing emails, often linking to ZIP archives hosted on Dropbox, to infect primarily HR staff in German-speaking countries. Once launched, Petya sought elevated privileges through a Windows UAC prompt, unpacked a malicious Setup.dll, overwrote boot structures including the MBR, and encrypted the NTFS Master File Table, leaving systems unable to boot normally or access files after a forced reboot. The malware used a Tor-based payment site, victim identifiers, and a cryptographic workflow involving elliptic-curve cryptography, AES, Base58, and Salsa20. To improve infection success, the operators added Mischa as a fallback payload for cases where administrator rights were not obtained. Unlike Petya, Mischa could encrypt files without elevated privileges, worked offline, targeted a wide range of file types across fixed, removable, and remote drives, and used reflective DLL injection into conhost.exe. Researchers later described this dual-payload approach as evolving into GoldenEye, while noting that Mischa’s conventional file encryption could be harder to reverse through forensic recovery than Petya’s disk-level attack; the campaigns were widely linked to actors operating under the name Janus.
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
