chaos | 234[.]zip | Triage™

Resubmissions

31/03/2024, 14:49

240331-r687xsec7710

29/03/2024, 09:29

29/03/2024, 08:58

29/03/2024, 08:57

29/03/2024, 08:49

Sharing

Copy URL Twitter E-mail

General

Target
234.zip
Size 111KB
Sample240331-r687xsec77
SHA256 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf
MD5 5e7e62594a2982835c7aea2fa131b393
SHA1 7319b88fc092922534b53ee7b37297ac4dfcf839
SHA512 08edf60a7e55a9e9d90f48baacc290e039952c1da45cf56a2b850cd740cd97b1f67bea6456730f2d8f20ca6e9787ed4b81740182ee771b5a9844e4fe53da82a3
SSDEEP 1536:VYLMdhI1JzP3TynJWM5xkcXp4siewExDNOm3nmHyJGwlILvFlAY/2BE54DqHAzXE:zUDWLx54s/nxDN1WECLzF4qHcPbJL6Bn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/antivirus.exe	family_chaos

Chaos family
chaos

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/antivirus.exe
unpack001/decryptor-decrypter/Decrypter.exe

File Explorer

234.zip

.zip 111KB
antivirus.exe

.exe 144KB
decryptor-decrypter/Decrypter.exe

.exe 218KB
decryptor-decrypter/privateKey.chaos

.xml 1KB
decryptor-decrypter/publicKey.chaos

.xml 397B

234.zip

SHA256 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf
MD5 5e7e62594a2982835c7aea2fa131b393
SHA1 7319b88fc092922534b53ee7b37297ac4dfcf839
SHA512 08edf60a7e55a9e9d90f48baacc290e039952c1da45cf56a2b850cd740cd97b1f67bea6456730f2d8f20ca6e9787ed4b81740182ee771b5a9844e4fe53da82a3
SSDEEP 1536:VYLMdhI1JzP3TynJWM5xkcXp4siewExDNOm3nmHyJGwlILvFlAY/2BE54DqHAzXE:zUDWLx54s/nxDN1WECLzF4qHcPbJL6Bn
MD5 SHA1 SHA512 SSDEEP

antivirus.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fbbaef754d6dafaaf32ae5e7937135fe81075806e5e2b0db1d6f9441a1cd8633
MD5 4016477fd044882c78f3c1a47d7322e1
SHA1 6c75ffa25ef2d1d6a658ff415b2e47964032fc6a
SHA512 17706a8238817e135ffe378e60e1e52964a00aeee6c6b9bc7f288a0390ae97d958f053cf693a4d829a35acbe32e3ab9599c13150a3155c671490736e88d19df1
SSDEEP 3072:xokEUyr9ql5n3yU6S4M5Er8zwIMsoE0WNOBKHAHp+FBZ+:er9ql53y04QEwzh0FaAHQLZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Chaos Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

153358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

decryptor-decrypter/Decrypter.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fac94a8e02f92d63cfdf1299db27e40410da46c9e86d8bb2cd4b1a0d68d5f7a2
MD5 97f3854d27d9f5d8f9b15818237894d5
SHA1 e608608d59708ef58102a3938d9117fa864942d9
SHA512 25d840a7a6f0e88092e0f852690ed9377cf3f38e0f2c95e74f8b2ffea574d83c6154cccdbf94f1756e2bbdcdb33b5106aab946644dedc4ffaefb6bf57a866696
SSDEEP 1536:PJG/sX9Ik6sq2njM9qRYxSKCxly16Pn6RikC:PJG/sX9i2YcRPm16Pn6ckC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\User\Desktop\decrypter\decrypter\obj\Debug\Chaos ransomware decrypter.pdb

234.zip

antivirus.exe

mscoree

dotnet

decryptor-decrypter/Decrypter.exe

mscoree

dotnet

decryptor-decrypter/privateKey.chaos

decryptor-decrypter/publicKey.chaos