General
- Target 234.zip
- Size 111KB
- Sample240329-kw8ebaed26
- SHA256 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf
Score
10/10
Malware Config
Targets
-
- Target antivirus.exe
- Size 144KB
- SHA256 fbbaef754d6dafaaf32ae5e7937135fe81075806e5e2b0db1d6f9441a1cd8633
Score10/10Chaos
Ransomware family first seen in June 2021.
Chaos Ransomware
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Sets desktop wallpaper using registry