chaos

General

Target

Xclinet.exe
Size

140KB
Sample

240323-vp3klahg49
MD5

066f7723bbfa71ece05354f0ccb426dc
SHA1

45f9e00fd1cf2be0e5825e951c582e7c117f451c
SHA256

b1f040dfbc18222c390a807de1bea52974808ef37dea145fe34e3a75dff99b7f
SHA512

eb92d1c550a073a28cbc961be4d280893bc50ed7243e5adb5ca08fe7c2748b9719cc39f21bd96de7f13ecf7a28520f631b0226a8d953412a7b4be589329fefd1
SSDEEP

1536:kh4ylNPpv6jlSsI0h4npvb9iSL6n0mTOXfpAf+YXLK5RJX1:kh4yQJendb9jLmOef+YXQ7

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

throughout-taxation.gl.at.ply.gg:48020

Attributes

Install_directory
%AppData%
install_file
xworm connected?.exe

Extracted

Path

C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt

Ransom Note

All of your files have been encrypted. Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software. This software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is $50. Payment can be made in Bitcoin (Bitcoin Address: bc1qakhl8eu20ely220fxm6d3tjsk2al64vrha4sxa), Ethereum (ETH Address: 0x22D2C1C38b3c26C9E403B34ea5aF42Af00e90d9f), Binance Coin (BNB Address: bnb17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV0205gfc6ykk), or through PayPal (Burner Account: [email protected]). You can make the payment directly by visiting this PayPal site: PayPal Payment Site. How do I pay, where do I get Bitcoin, Ethereum, Binance Coin, or PayPal? Purchasing Bitcoin, Ethereum, or Binance Coin varies from country to country, you are best advised to do a quick Google search yourself to find out how to buy Bitcoin, Ethereum, Binance Coin, or set up a PayPal account. These sites will help you to get fast and reliable Bitcoin, Ethereum, Binance Coin, or PayPal. Coinmama - https://www.coinmama.com Bitpanda - https://www.bitpanda.com If you will try to seek for help or advice we recommend not to. Why you ask? Because no other software can decrypt this ransomware, only us have the special key to unlock it. So getting other decrypters will be worthless. Don't even think about calling the cops; we will snitch about your pedo activity! You have exactly 12 hours from now to pay up or your PC will be locked for a very long time, approximately 125 Years! Have fun buddy. We monitor every move you make, 👁️‍🗨️ with 8 eyes on you, always one step ahead 👁️, lurking in your devices.

Emails

[email protected]

URLs

https://www.coinmama.com

https://www.bitpanda.com

Targets

- Target
  
  Xclinet.exe
- Size
  
  140KB
- MD5
  
  066f7723bbfa71ece05354f0ccb426dc
- SHA1
  
  45f9e00fd1cf2be0e5825e951c582e7c117f451c
- SHA256
  
  b1f040dfbc18222c390a807de1bea52974808ef37dea145fe34e3a75dff99b7f
- SHA512
  
  eb92d1c550a073a28cbc961be4d280893bc50ed7243e5adb5ca08fe7c2748b9719cc39f21bd96de7f13ecf7a28520f631b0226a8d953412a7b4be589329fefd1
- SSDEEP
  
  1536:kh4ylNPpv6jlSsI0h4npvb9iSL6n0mTOXfpAf+YXLK5RJX1:kh4yQJendb9jLmOef+YXQ7
Score

10^/10

chaos xworm persistence ransomware rat spyware stealer trojan
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1