chaos

General

Target

2024-02-12_1c8cf23419801ef9123eb04564038e70_destroyer_wannacry
Size

27KB
Sample

240212-f5vglafc76
MD5

1c8cf23419801ef9123eb04564038e70
SHA1

9e84a94c366b50dbbaf9ce4f698607321cf91649
SHA256

182eb68338b793c89aada825d2916345c4dd285f8af4e6d9e4c7adf437241a15
SHA512

76347bbcc6a6c404fff18de5f71ff102c5d7c2b4375434bc8402105ce648fe3d163ddb8c601b7e2e0a2261559613a2dcfb2f914f224a06656c81bbce0766eac3
SSDEEP

384:KtWZPzzxAm1vpyNDdpjCG/N/yO/lCOy5o91en7fFzo82vv:v7zxAmyDCG/0Bho9cn7dE82X

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\rea9651d_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-02-12_1c8cf23419801ef9123eb04564038e70_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  1c8cf23419801ef9123eb04564038e70
- SHA1
  
  9e84a94c366b50dbbaf9ce4f698607321cf91649
- SHA256
  
  182eb68338b793c89aada825d2916345c4dd285f8af4e6d9e4c7adf437241a15
- SHA512
  
  76347bbcc6a6c404fff18de5f71ff102c5d7c2b4375434bc8402105ce648fe3d163ddb8c601b7e2e0a2261559613a2dcfb2f914f224a06656c81bbce0766eac3
- SSDEEP
  
  384:KtWZPzzxAm1vpyNDdpjCG/N/yO/lCOy5o91en7fFzo82vv:v7zxAmyDCG/0Bho9cn7dE82X
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2