General
-
Target
illegal and unillegal.rar.zip
-
Size
212KB
-
Sample
220501-wz279adge8
-
MD5
cf68a7691275717534bc060aba66ffc8
-
SHA1
b478621b7c2a3ce4948fbc0aa29502e207eb6fe9
-
SHA256
e47cf35ebb754112c2edca1645a40e0d7985db3a70c93c453c434bef93d23c73
-
SHA512
9f61a74c9d398f35733802f030f200f70b492baab167b80c30cbecefff777336c29f4b0af05c20b6fb7112fc05d999595401481eb034bba0e3f003948bc92e76
Static task
static1
Behavioral task
behavioral1
Sample
illegal and unillegal/dead.exe
Resource
win7-20220414-en
Malware Config
Extracted
C:\Users\Admin\Desktop\readme.txt
https://www.astolfo.lgbt/
https://absolllute.com/store/view_mega_hack_pro
https://x.synapse.to/
https://script-ware.com/
https://protosmasher.net/
Extracted
C:\Users\Admin\Downloads\AssertBlock.mht
ryuk
Targets
-
-
Target
illegal and unillegal/dead.exe
-
Size
985KB
-
MD5
37a0d42671350931168039739cd65c4f
-
SHA1
e372320a7d1d073a913891e20468932a86c4a086
-
SHA256
8864d707d5e91e1c073e5d3bd4324793202449c647b1b1936df35fd734635d4a
-
SHA512
2f3828bd2525dd8b6cc8daae7e2bcff2ba508c2841eaaf8a0faa359ea9e07f7387bf503c309ece096e6899627d5e9a9c90abf7d197bb8199e4db28b83d03a93c
-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-