Behavioral task
behavioral1
Sample
2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.exe
Resource
win10v2004-20230221-en
General
-
Target
2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.zip
-
Size
3.8MB
-
MD5
65ff3ccc0829f7f435817bc5117608d5
-
SHA1
b5501e9b789861bdb793d7abc934e75e86b915a4
-
SHA256
539d33ec5eaa19b03666f469a687aa7ae5c0d3252111767f973ff8dbc518fa66
-
SHA512
87be3e931b5f1034e5ac22e83f0d12eeb55dcefa0a1070abcce2dfc92e67dcc5aac00c133f2996429c246bb37ebd0b83e406ae4b615194777f18fcbd8815bb9f
-
SSDEEP
98304:ybXR7suPsaaUI0GPn5c+fmoA6XHiAFxR224tS+7:QbKf0GhcG06XHiALEDtS+7
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.exe family_chaos -
Chaos family
Files
-
2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.zip.zip
Password: infected
-
2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ