General
-
Target
521875e890e1b8d72c79fc9c71e613ca1a2475b913c2527bd0e965257cf742fb.exe
-
Size
26KB
-
Sample
240128-27bcdsdhfl
-
MD5
907b144e9db44a1b844fa4f2fceadc59
-
SHA1
f1396b56939ef9ecfae22e2a93fc696299383b43
-
SHA256
a5e2d75d8aaabee014dbc7158cbd283be41759f43277191076fd851f3a217369
-
SHA512
41db4aaf85abeff4e00289e3f60c5f692ba291ed006ed3eb7c801c38b3f11d589e7da81e4c6f5c2c2c4ddcb80420cb61fc7b6c5e5c3740449eda0a306ce3b884
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QJb5hxDGP:5OElB6sc9GJbXxDE
Behavioral task
behavioral1
Sample
521875e890e1b8d72c79fc9c71e613ca1a2475b913c2527bd0e965257cf742fb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
521875e890e1b8d72c79fc9c71e613ca1a2475b913c2527bd0e965257cf742fb.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Targets
-
-
Target
521875e890e1b8d72c79fc9c71e613ca1a2475b913c2527bd0e965257cf742fb.exe
-
Size
26KB
-
MD5
907b144e9db44a1b844fa4f2fceadc59
-
SHA1
f1396b56939ef9ecfae22e2a93fc696299383b43
-
SHA256
a5e2d75d8aaabee014dbc7158cbd283be41759f43277191076fd851f3a217369
-
SHA512
41db4aaf85abeff4e00289e3f60c5f692ba291ed006ed3eb7c801c38b3f11d589e7da81e4c6f5c2c2c4ddcb80420cb61fc7b6c5e5c3740449eda0a306ce3b884
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QJb5hxDGP:5OElB6sc9GJbXxDE
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Renames multiple (187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-