chaos | fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9 | Triage

Submit
Reports

Overview

overview

Static

static

fc68c5aab3...f9.exe

windows7-x64

fc68c5aab3...f9.exe

windows10-2004-x64

Sharing

General

Target

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9
Size

22KB
Sample

221028-sqr45sgdem
MD5

f38910f1c71e210f710b0d2aed182f55
SHA1

b1ec33aafba903812914d2b8d90c5ee0c6055107
SHA256

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9
SHA512

0c8e3315c062f41134df5ef534923b1ade7d7eaf804f789ced322638113c1e9e4228131cbd43fc2713d419e3ba12c5d43e43fdad1e04684998282e1f58b3391b
SSDEEP

384:63Mg/bqo2etUq4/fHapyj8ZOjPJNr91CaTb5geM:Aqo2jNSpjZOjhNr9ZTbeeM

Score

10^/10

chaos evasion ransomware spyware stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe

Resource

win7-20220901-en

chaos ransomware

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe

Resource

win10v2004-20220812-en

chaos evasion ransomware spyware stealer

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9
- Size
  
  22KB
- MD5
  
  f38910f1c71e210f710b0d2aed182f55
- SHA1
  
  b1ec33aafba903812914d2b8d90c5ee0c6055107
- SHA256
  
  fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9
- SHA512
  
  0c8e3315c062f41134df5ef534923b1ade7d7eaf804f789ced322638113c1e9e4228131cbd43fc2713d419e3ba12c5d43e43fdad1e04684998282e1f58b3391b
- SSDEEP
  
  384:63Mg/bqo2etUq4/fHapyj8ZOjPJNr91CaTb5geM:Aqo2jNSpjZOjhNr9ZTbeeM
Score

10^/10

chaos ransomware evasion spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

chaosransomware

behavioral2

chaosevasionransomwarespywarestealer

© 2018-2025

Terms | Privacy