chaos

General

Target

028d8a0f2eefdc87bcfde1457470789c.bin
Size

1.2MB
Sample

230307-bcwrqsge47
MD5

9073e7b7691076ad6e10095251c95b74
SHA1

8782beee1ecc5af445d382bd5de61b2dbbf6cb31
SHA256

2dfba8736422fd1f0d068c5729751cb63a648763ec6c333534bf9f4283c5bd3a
SHA512

75297e52b80650db02fed78c7cd73deeb7e87571b19efafbeecce949a9bf847bb6a23cc2c5942dc20ba513100d96a72133acabf1bd25cf4dab0a78f357342037
SSDEEP

24576:4oa2X/8O0WU05E82YKvkLvzI9hxx2qE9pPwyZZSRhFJzXnzydSZ:r8OlD5EzvkLvQl2l9pTZZSRhFlXed2

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\How to Recovery.bat

Ransom Note

echo off color 0a cls :MENU ECHO. ECHO -----------------Attention----------------- ECHO. ECHO. Your All Files Have been Encrypted! ECHO. ECHO Your Personal files (Documents, Databases, All Drive, PDF, ETC.) We re encrypted. ECHO. But don't worry about your files,You can take back all of them, To decrypt your all files need ECHO. to buy Our Software With your unique private key. Only our software well allow decrypt your files. ECHO. Remember if you try to recovery your files through any third-party software, ECHO. it's can cause premature damage to your files, and we can't help you either. ECHO. ECHO. -----------------Note!----------------- ECHO. ECHO. You have only 72 hours from the moment when an encryption was done to buy our software at $200 for the payment ECHO. ECHO. BTC Address:- 33j4JbAEzZwWGgA2MxBARD7zprJuNDP2hP ECHO. ECHO. And if you Payment complete then Send me proof. ECHO. ECHO. Use the following ID as the title of your email:- QA2Z67DXLBFF05FHN ECHO. ECHO. Use these emails to contact us and receive instructions:- ECHO. ECHO. Main email:- [email protected] ECHO. ECHO. Secondary email ( in case of no response in 48h):- [email protected] ECHO. ECHO. Also, you can send up to 3 test files to see if we can decrypt your files. ECHO. ECHO. After paying, the decryptor software and your private key will be given to you. ECHO. SET /P M=

Emails

[email protected]

Wallets

33j4JbAEzZwWGgA2MxBARD7zprJuNDP2hP

Targets

- Target
  
  a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267.exe
- Size
  
  2.7MB
- MD5
  
  028d8a0f2eefdc87bcfde1457470789c
- SHA1
  
  a9f41548d827728e44cb0296b05ae23295698c46
- SHA256
  
  a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267
- SHA512
  
  931b9ddeba173931968f80d144a3fd851236744c12212a6e723c88ffd7c720b7ec2538b655fe680a80c66d65a3ca541bcbbf3abfd1e353eef0dfb2fa3d9594f5
- SSDEEP
  
  24576:bvS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:bvSy6PX3PpM+P5Id
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2