chaos | 9035106690[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
9035106690.zip
Size 7.2MB
Sample231018-pchf1aec8x
SHA256 0beba1c428f350e024253c46dc43e9fc4480fb513355edfec452d13fff38f6d0
MD5 ef2cacf47d7cde4871c1f1d00cb8d3e6
SHA1 05550cc73c3507a39ab9ae94a08134af2dbd11e7
SHA512 b862a5885fd336c56419aba841aaf8a115f13ae25a59efb19d493d06e523c9548d31e82f2b2d9b2a387af90b932bc8319c8244b4fb7c9ec6a606179157b3ad25
SSDEEP 196608:SiVR2zqrbvQBiXZU+ENVUX8lrMMd6KNkPP:LqzqAwu+oVUX8GMUKUP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos mafiaware666 maui venus blackcat njrat

Malware Config

Signatures

Blackcat family
blackcat

Chaos Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e	family_chaos

Chaos family
chaos

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e	family_mafiaware666

Detect Maui ransomware 1 IoCs

resource	yara_rule
static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e	family_maui

Mafiaware666 family
mafiaware666
Maui family
maui
Njrat family
njrat

Venus Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e	family_venus

Venus family
venus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e

File Explorer

9035106690.zip

.zip 7.2MB
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e

.exe 14.9MB

9035106690.zip

SHA256 0beba1c428f350e024253c46dc43e9fc4480fb513355edfec452d13fff38f6d0
MD5 ef2cacf47d7cde4871c1f1d00cb8d3e6
SHA1 05550cc73c3507a39ab9ae94a08134af2dbd11e7
SHA512 b862a5885fd336c56419aba841aaf8a115f13ae25a59efb19d493d06e523c9548d31e82f2b2d9b2a387af90b932bc8319c8244b4fb7c9ec6a606179157b3ad25
SSDEEP 196608:SiVR2zqrbvQBiXZU+ENVUX8lrMMd6KNkPP:LqzqAwu+oVUX8GMUKUP
MD5 SHA1 SHA512 SSDEEP

Password

infected

1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e

IMPHASH aa466c044f0d2d2f6270070fe1bddf7b
SHA256 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
MD5 97abffeaa7bdfaa81532bd6028498225
SHA1 26ab576a0abf7085ecf6321a311a7b3088ee48ae
SHA512 af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
SSDEEP 196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64

Chaos Ransomware
Detect MafiaWare666 ransomware
Detect Maui ransomware
Venus Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

CreatePropertySheetPageA PropertySheetA

kernel32

FreeLibrary SetStdHandle GetStdHandle LocalFree FormatMessageA GetTempFileNameA GetTempPathA GetModuleHandleA GetVersionExA ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread SetThreadPriority CreateProcessA GetModuleFileNameA RemoveDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GetModuleFileNameW SetEndOfFile CreateFileW GetFileSize HeapSize WriteConsoleW FlushFileBuffers IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW LCMapStringW GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW SetConsoleCtrlHandler GetConsoleMode GetConsoleCP SetHandleCount FatalAppExitA DeleteCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwindEx SetFilePointer ReadFile DeleteFileA LoadLibraryA GetProcAddress MultiByteToWideChar lstrlenA CompareStringW UnmapViewOfFile CreateFileA GetLastError DosDateTimeToFileTime SetFileTime CloseHandle CreateFileMappingA MapViewOfFile GetFileAttributesA CreateDirectoryA SetLastError Sleep GetProcessHeap SetEnvironmentVariableA SetEnvironmentVariableW WriteFile HeapDestroy GetSystemTimeAsFileTime HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFileType EnterCriticalSection LeaveCriticalSection GetDateFormatA GetTimeFormatA HeapReAlloc GetModuleHandleW ExitProcess DecodePointer GetCommandLineA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer WideCharToMultiByte GetTimeZoneInformation GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree GetCurrentThreadId FlsAlloc HeapSetInformation GetVersion HeapCreate

user32

wsprintfA GetFocus MessageBoxA SetCursor GetDlgItem SendDlgItemMessageA GetParent PostMessageA GetWindowRect MoveWindow LoadCursorA RegisterClassA CreateWindowExA ShowWindow UpdateWindow DefWindowProcA BeginPaint GetSystemMetrics EndPaint TranslateMessage DispatchMessageA PeekMessageA GetDC ReleaseDC SendMessageA SetDlgItemTextA

gdi32

CreateFontA SelectObject SetBkMode TextOutA SetTextColor DeleteObject CreateDIBitmap CreateSolidBrush

advapi32

RegSetValueExA RegEnumKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegQueryValueA

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitialize CoUninitialize