chaos

General

Target

ClassiCube.exe
Size

1017KB
Sample

240217-bexrtahe5w
MD5

9d2b53c13e0b5a3e39d9949095e373a7
SHA1

ed8fc11be6a876904f449deb9a1a985d751421ff
SHA256

bca347cddd5a278f351af6e15ac0be36c228d5075045d8200cca6c04406d22f3
SHA512

681c18e3eceecc722d03f9e1ce71861b49be88a755b10aea9298e6cfaa2cc4128b534e058c4cbfac79e37be775f5fdf2f0748e08601106f2d95fa0707b2f07d0
SSDEEP

24576:VOhNH0oZYWOhIEId4YbEtUg8msZy0Qjvw9:wNH0ov+ihVavw

Score

10^/10

Malware Config

Targets

- Target
  
  ClassiCube.exe
- Size
  
  1017KB
- MD5
  
  9d2b53c13e0b5a3e39d9949095e373a7
- SHA1
  
  ed8fc11be6a876904f449deb9a1a985d751421ff
- SHA256
  
  bca347cddd5a278f351af6e15ac0be36c228d5075045d8200cca6c04406d22f3
- SHA512
  
  681c18e3eceecc722d03f9e1ce71861b49be88a755b10aea9298e6cfaa2cc4128b534e058c4cbfac79e37be775f5fdf2f0748e08601106f2d95fa0707b2f07d0
- SSDEEP
  
  24576:VOhNH0oZYWOhIEId4YbEtUg8msZy0Qjvw9:wNH0ov+ihVavw
Score

10^/10

chaos bootkit evasion persistence ransomware spyware stealer trojan upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1