chaos

Target
b28242123ed2cf6000f0aa036844bd29
Size 87KB
Sample240314-l2whdabe69
SHA256 fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
MD5 b28242123ed2cf6000f0aa036844bd29
SHA1 915f41a6c59ed743803ea0ddde08927ffd623586
SHA512 08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
SSDEEP 1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b28242123ed2cf6000f0aa036844bd29
- Size 87KB
- SHA256 fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
- MD5 b28242123ed2cf6000f0aa036844bd29
- SHA1 915f41a6c59ed743803ea0ddde08927ffd623586
- SHA512 08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
- SSDEEP 1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos bootkit evasion motw persistence phishing ransomware spyware stealer trojan upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1