Extracted

• • Target

    e48138f16524da77e9d85ec11596e668664c116bcd3c995641af0d52c0526def

  • Size

    335KB

  • MD5

    baad3244b1b5663e0a7f121d90edd298

  • SHA1

    22a518e2ab331a1eaff6069b722d627638fbfbef

  • SHA256

    e48138f16524da77e9d85ec11596e668664c116bcd3c995641af0d52c0526def

  • SHA512

    9a3d61ef1061528aa9ca7289aa50af1d5d5b755159dd231d4a1594354992719f3f29058411a1bac38fc97b2a73cf6159b181b55e416a002404f053d5140a58ca

  • SSDEEP

    6144:0D9c9kL94GeFdhL29TuuXglosdU4GjbKqBaQy/oOERKlJ6LaY8:0x54GeFddmpXg+sdUhjWsat/oOERKz6G

  Score

  10^/10

  chaosevasionransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Detects command variations typically used by ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (169) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2