Extracted

• • Target

    PrivateChat V2.0.exe

  • Size

    87KB

  • MD5

    4e0daa19b125c8e2703e9de440b1340b

  • SHA1

    8dd7592a40384093ab296ea4a0ae14102441b884

  • SHA256

    2dcc9c629488710a424dba2eefcfbecbf1edcc092a8387be7929db59f9692e71

  • SHA512

    8bf90f3d89e0592b5e5f1f6b1d5a362b1db84612eb8f737bec7e17c25e8e9748dd0293e40addea8f77c4f49e7e3a1e345ff78e1ee150dc29bfb643bbdb78e040

  • SSDEEP

    1536:SPvg251EzYY2MkcqhQP6xY9G+beYZFy+U0/A1OG36zvO5d2LueRISbfX:SPvg2szr5kcqhgx8+be+yTL+OjOusr

  Score

  10^/10

  xwormrattrojanchaosevasionransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2