General
-
Target
55d3ae2adab4301ae8ff6d84c9dad332e51cbf7c15b0548b10ac37ccc47550be.exe
-
Size
26KB
-
Sample
240128-29l7nscee2
-
MD5
88e39005a1145337d615aa22576d1359
-
SHA1
8c5000dead78d34e5916bc4594ae564bfdcbe1cf
-
SHA256
c4a924d2e93e9aca4e57ebff39f26cc389e87190f14d480ef032f3eaf705aa08
-
SHA512
15e859de8c91e54d32d753740222d80957f391c6766f0a99f4a602b3ec651c89693cd3c8359bd52a2c27ebec886841cc671e8023917c7345b7555ea0a62dda3d
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qkb5hxDGX:5OElB6sc9GkbXxDc
Behavioral task
behavioral1
Sample
55d3ae2adab4301ae8ff6d84c9dad332e51cbf7c15b0548b10ac37ccc47550be.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55d3ae2adab4301ae8ff6d84c9dad332e51cbf7c15b0548b10ac37ccc47550be.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Targets
-
-
Target
55d3ae2adab4301ae8ff6d84c9dad332e51cbf7c15b0548b10ac37ccc47550be.exe
-
Size
26KB
-
MD5
88e39005a1145337d615aa22576d1359
-
SHA1
8c5000dead78d34e5916bc4594ae564bfdcbe1cf
-
SHA256
c4a924d2e93e9aca4e57ebff39f26cc389e87190f14d480ef032f3eaf705aa08
-
SHA512
15e859de8c91e54d32d753740222d80957f391c6766f0a99f4a602b3ec651c89693cd3c8359bd52a2c27ebec886841cc671e8023917c7345b7555ea0a62dda3d
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qkb5hxDGX:5OElB6sc9GkbXxDc
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-