General
-
Target
0cb05a2de06528c9ae5023091ce7a4528f77d3c63f3bf57648d260e46843fb76.exe
-
Size
26KB
-
Sample
240128-x5z6hsgfa2
-
MD5
fedbf39b3d664aca7220230530dcf730
-
SHA1
3573617bb8ce3a5140d9eaf2488e9a043ab8795c
-
SHA256
4cb707f895e04fabe6fed83743972e8c0b0fe4ab855212b03e7889fe50f0929f
-
SHA512
d02bd3d710a5be3dec7fc1dceb5c32101cc8cdc226348bb36a80f052212e2779052226301d3eaf51cae5aa697deeb10ba937d5aa55c4833804dd21a6c56a41dd
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QTb5hxDGU:5OElB6sc9GTbXxD/
Behavioral task
behavioral1
Sample
0cb05a2de06528c9ae5023091ce7a4528f77d3c63f3bf57648d260e46843fb76.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0cb05a2de06528c9ae5023091ce7a4528f77d3c63f3bf57648d260e46843fb76.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Targets
-
-
Target
0cb05a2de06528c9ae5023091ce7a4528f77d3c63f3bf57648d260e46843fb76.exe
-
Size
26KB
-
MD5
fedbf39b3d664aca7220230530dcf730
-
SHA1
3573617bb8ce3a5140d9eaf2488e9a043ab8795c
-
SHA256
4cb707f895e04fabe6fed83743972e8c0b0fe4ab855212b03e7889fe50f0929f
-
SHA512
d02bd3d710a5be3dec7fc1dceb5c32101cc8cdc226348bb36a80f052212e2779052226301d3eaf51cae5aa697deeb10ba937d5aa55c4833804dd21a6c56a41dd
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QTb5hxDGU:5OElB6sc9GTbXxD/
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-