chaos

General

Target

Sin título.png
Size

28KB
Sample

240217-f7keeabf61
MD5

37e9f24b247bed8f268acf8ec1f08f69
SHA1

879b786dea7be46f8da94afae496d340312da128
SHA256

debc291862357db9a51237f838d5b27c8e8bbae4c25e23f2b629e5824db43a58
SHA512

edaa59a6dd07cb25c969428450a54b3d8aac9a4a6610e495210f0d24ff05682ede373b520952bb0b0477a3b8b7019002512da8b768eecc81145dfd2a7eee2755
SSDEEP

384:Qs0a4H9r5yTunEzgJUiLwwftlBRbfqkqyvHd:Qs0V1oTuES3ll/7Zl

Score

10^/10

Malware Config

Targets

- Target
  
  Sin título.png
- Size
  
  28KB
- MD5
  
  37e9f24b247bed8f268acf8ec1f08f69
- SHA1
  
  879b786dea7be46f8da94afae496d340312da128
- SHA256
  
  debc291862357db9a51237f838d5b27c8e8bbae4c25e23f2b629e5824db43a58
- SHA512
  
  edaa59a6dd07cb25c969428450a54b3d8aac9a4a6610e495210f0d24ff05682ede373b520952bb0b0477a3b8b7019002512da8b768eecc81145dfd2a7eee2755
- SSDEEP
  
  384:Qs0a4H9r5yTunEzgJUiLwwftlBRbfqkqyvHd:Qs0V1oTuES3ll/7Zl
Score

10^/10

chaos bootkit evasion persistence ransomware spyware stealer trojan upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1