chaos

General

Target

chaosgate.zip
Size

146KB
Sample

220211-ht6rladgep
MD5

da2a03719064154d95a16085ae5b642f
SHA1

529a9376101a05298d027fa82b07f25d225c2abd
SHA256

3e044ab5ff896fbe79fdb0064c5be49986fe22c43692dcd0e3da6f1500440860
SHA512

c8ed8f339b94b87990516d7c32948cf6630d482c1aab4b1ebac5293c3c155695a24732144e7bc885049ebfd1658a5c50878d5fd47cfa2ecbeb97dbbc7488eb93

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_me.txt

Ransom Note

----> SHQ is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $42,899.40. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 1337.00 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Targets

- Target
  
  0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe
- Size
  
  314KB
- MD5
  
  9ccf43bbfaccb1a377e0b87f3f7f538c
- SHA1
  
  91d70b30f9232435776d0f6839f6ff7ac4fb586d
- SHA256
  
  0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56
- SHA512
  
  64373dc9798701747581c01bb21c4ba672c948e4232b4d1db8ec6a492581147451e31509a3e3f2be647fd4cea95783b4c83f7764f181508ae20c4887001a672c
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2