chaos

General

Target

Vm.jpeg
Size

1KB
Sample

240216-k4twwsff56
MD5

963255911b226b2cb4e92381bc86547b
SHA1

2809c265b4fce2809c4057027cda650219d023a5
SHA256

768f7d4c30fb287eed6f429055575e10fa3d67419116b55105d2ebdbfecf633c
SHA512

32825f83595a4497afbc6e7e09dc9d8cb8921685f8d98efd29fa36e6ffab7ca5589426f47b011daaf16e245b1ab3d74748e5ef0cb42e96aadea77737dacbcdf8

Score

10^/10

Malware Config

Targets

- Target
  
  Vm.jpeg
- Size
  
  1KB
- MD5
  
  963255911b226b2cb4e92381bc86547b
- SHA1
  
  2809c265b4fce2809c4057027cda650219d023a5
- SHA256
  
  768f7d4c30fb287eed6f429055575e10fa3d67419116b55105d2ebdbfecf633c
- SHA512
  
  32825f83595a4497afbc6e7e09dc9d8cb8921685f8d98efd29fa36e6ffab7ca5589426f47b011daaf16e245b1ab3d74748e5ef0cb42e96aadea77737dacbcdf8
Score

10^/10

chaos bootkit evasion persistence ransomware spyware stealer trojan upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1