{
  "family": "himera",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nHimera (or Himera Stealer) is a commercially available Information Stealer (Info-Stealer) sold on underground cybercrime forums. It provides threat actors with a low-cost, effective tool designed to rapidly extract sensitive data, credentials, and financial information from compromised Windows endpoints before the victim realizes they have been infected.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHimera is distributed through various vectors, primarily malspam campaigns containing weaponized Office documents (macros), disguised as cracked software on torrent sites, or via malicious links in YouTube tutorial descriptions (often promising free game cheats).\n\nUpon execution, it performs a rapid, highly aggressive data harvesting operation:\n<ul>\n<li><strong>Browser Data Extraction:</strong> It specifically targets Chromium and Gecko-based web browsers to extract saved passwords, autofill data, credit card numbers, and session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>Cryptocurrency Wallet Theft:</strong> Himera actively searches the filesystem for desktop cryptocurrency wallets (Bitcoin, Ethereum, Monero, etc.), stealing the `wallet.dat` files and associated authentication tokens.</li>\n<li><strong>System Profiling and Exfiltration:</strong> It collects extensive system details (hardware specs, installed software, IP address), grabs a desktop screenshot, and packages all stolen data into a compressed archive. This archive is then exfiltrated via HTTP POST requests or directly to a Telegram bot controlled by the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Himera Stealer infection is a critical data breach. The malware is designed to execute quickly; by the time the initial executable is detected by standard antivirus, the data exfiltration has usually already completed. The stolen session tokens and credentials can be immediately used to access corporate networks or drain financial accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> The absolute highest priority is a complete password reset. ALL credentials saved in the user's browser, as well as their domain password, must be changed immediately from a *different, clean device*.</li>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications (O365, Google Workspace, Slack, Discord) to invalidate the stolen tokens.</li>\n<li><strong>Endpoint Eradication:</strong> While the primary malware executable can often be removed by EDR, the extent of the data breach necessitates a full forensic review. Re-imaging the machine is highly recommended to ensure no secondary backdoors were deployed during the infection.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Himera",
    "PWS.Himera",
    "TrojanSpy.HimeraStealer"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1539",
    "T1056.001",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:43:01Z",
  "type": "Information Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}