Overview

overview

10

Static

static

10

7a3e70ae30...b0.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7a3e70ae309a73659d5e5cbee5a719e9d419c3741ba24c1d68edf8ef218868b0.7z
  • Size 10KB
  • Sample240130-dk835sffb9
  • SHA256 3efd2229f4413b6656ad0052d133e171a29b36d7aa09961c4600e74d5b1e12bd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\read_it.txt

Ransom Note
  • ----> Apocalipse is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $100,000. Payment can be made in Bitcoin only. Payment informationAmount: 3.77633 BTC Bitcoin Address: bc1qszgpsw27r2yvn7xvucgnnjh48ua4h52ch30zlt contact : [email protected]

Targets

    • Target
      7a3e70ae309a73659d5e5cbee5a719e9d419c3741ba24c1d68edf8ef218868b0
    • Size 24KB
    • SHA256 7a3e70ae309a73659d5e5cbee5a719e9d419c3741ba24c1d68edf8ef218868b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    chaosevasionpersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks