chaos

General

Target

27ce94331702ce7c21e1b3f3c5cb0538c9964b7a00506c7f9d95938c69af5aac
Size

26KB
Sample

240201-gbjcxaedbp
MD5

02a9fd360038d5a7ec51f0c6db7c994f
SHA1

93b5f1ffc07ab6e63e2c065805372e02a3c421a9
SHA256

8fc505f03ea9d19f196ac291788fac060c046077616fc0dd551bd7b44ad3c29d
SHA512

12a5ae424396283de42d6313dfb62ee2a4b1098827f50ba4ecbbb45ec3251e947fffe19711bd63edbe71bb6b8d0314d0a42f4dc49b46c4873f9d63841d4270a9
SSDEEP

384:zYenjLLAps4T5lBavzb/xlhKOVp91QNb5hxDGj:aOElB6sc9GNbXxD4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Targets

- Target
  
  27ce94331702ce7c21e1b3f3c5cb0538c9964b7a00506c7f9d95938c69af5aac
- Size
  
  26KB
- MD5
  
  02a9fd360038d5a7ec51f0c6db7c994f
- SHA1
  
  93b5f1ffc07ab6e63e2c065805372e02a3c421a9
- SHA256
  
  8fc505f03ea9d19f196ac291788fac060c046077616fc0dd551bd7b44ad3c29d
- SHA512
  
  12a5ae424396283de42d6313dfb62ee2a4b1098827f50ba4ecbbb45ec3251e947fffe19711bd63edbe71bb6b8d0314d0a42f4dc49b46c4873f9d63841d4270a9
- SSDEEP
  
  384:zYenjLLAps4T5lBavzb/xlhKOVp91QNb5hxDGj:aOElB6sc9GNbXxD4
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Detects command variations typically used by ransomware
- Renames multiple (176) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2