Overview

overview

10

Static

static

1

GANGCRACKED.rar

windows7-x64

10

GANGCRACKED.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GANGCRACKED.rar

  • Size

    28.3MB

  • Sample

    240227-k46kpade8x

  • MD5

    fb95370edc412c293fcced895b4d4539

  • SHA1

    1bd433763a2e34ab00f350fa502bce49fb5eefdb

  • SHA256

    7a3eab6c4831e63a31be3b45edb8bd8d19ffc6706eb27d0097084a5e3f12da52

  • SHA512

    961fe0bc644d7e6f995575d04cc8182341b3b1a642305563019fef1c57c8fd6d0d5e9f0cdfaf788a3c92adf7b4724de33924755bf34bff63fc3351b9c282c14d

  • SSDEEP

    786432:/NzQyvK2dmI+DTIx3ib6yGwO0+L58Quty/PlVxc:FBCkmI+DTI9imyGWOSQugi

Score
10/10
chaosremcosdiscordnukerransomwarerat

Malware Config

Extracted

Path

C:\Users\Public\DynamicUserFolder\lib\lib2to3\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: aaaaa

Extracted

Family

remcos

Botnet

DiscordNuker

C2

185.81.157.223:1010

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    eb1d37a5-d986-4bae-a94e-415e7babddcc-D20BAI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      GANGCRACKED.rar

    • Size

      28.3MB

    • MD5

      fb95370edc412c293fcced895b4d4539

    • SHA1

      1bd433763a2e34ab00f350fa502bce49fb5eefdb

    • SHA256

      7a3eab6c4831e63a31be3b45edb8bd8d19ffc6706eb27d0097084a5e3f12da52

    • SHA512

      961fe0bc644d7e6f995575d04cc8182341b3b1a642305563019fef1c57c8fd6d0d5e9f0cdfaf788a3c92adf7b4724de33924755bf34bff63fc3351b9c282c14d

    • SSDEEP

      786432:/NzQyvK2dmI+DTIx3ib6yGwO0+L58Quty/PlVxc:FBCkmI+DTI9imyGWOSQugi

    Score
    10/10
    chaosremcosdiscordnukerransomwarerat

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks