chaos

General

Target

Version 2.8.exe
Size

227KB
Sample

240315-ay4h2aca6v
MD5

2ab8e3e63a7c847855ad80770dc2fd59
SHA1

dae76d78053f9699f4cb7ccae51df9d4b6202ac7
SHA256

7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b
SHA512

6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31
SSDEEP

6144:yR9ixUkjCMkI3pwo9EkhtNK3OotdWV3vBLGC:oof+ewfkhsnWBvBj

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note

All of your files have been encrypted! Warning Attempting to remove the software will corrupt your hard drives meaning no further use even when wiped. We simply charge $25 which is far cheaper than buying a new drive. Your computer was infected with a ransomware software. Your files have been encrypted and you won't be able to decrypt them without purchasing $25 BTC. What can I do to get my files back? You will send payment of $25 BTC to gain access to your files again, once payment is made after 3 confirmations on the blockchain (15 mins) your files will be restored and the software will un-install itself from your computer. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment will increase soon to double, be cooperative and your files will be released. Payment information Amount: 0.000385636 BTC Bitcoin Address: bc1qc76qr24pxnms9f93mytfg4dn7ztuvmje7g43dr

Targets

- Target
  
  Version 2.8.exe
- Size
  
  227KB
- MD5
  
  2ab8e3e63a7c847855ad80770dc2fd59
- SHA1
  
  dae76d78053f9699f4cb7ccae51df9d4b6202ac7
- SHA256
  
  7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b
- SHA512
  
  6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31
- SSDEEP
  
  6144:yR9ixUkjCMkI3pwo9EkhtNK3OotdWV3vBLGC:oof+ewfkhsnWBvBj
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2