chaos | 94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d[.]zip

General

Target
94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip
Size 375KB
Sample240402-bm147scd6w
SHA256 94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d
MD5 55c5f95a5ce1154c61d38b3eda83ad19
SHA1 9dc914ef0a0dc1bc43169cf87c6b23ddb60ec966
SHA512 f6be0297bcfecc03b1309a984d45839c0e5ada10e75c707dbef16da777a3adb8bd42b12639ce7cde9d9ccb352f871b4b7623da2738c1c2852bac4fcc2e34702b
SSDEEP 6144:taKYsu0ULNbubfC0/2wYiY1+E+Wi73Cx8x0Sn+QOJ2FUJ1EqO3d12opWKoAte:oKY5VLNbV0+iY1l76SH8+XYFEEVNjpWx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60	family_chaos

Chaos family
chaos

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
static1/unpack001/37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60	INDICATOR_SUSPICIOUS_GENRansomware

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

File Explorer

94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip

.zip 375KB
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

.exe 953KB

94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip

SHA256 94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d
MD5 55c5f95a5ce1154c61d38b3eda83ad19
SHA1 9dc914ef0a0dc1bc43169cf87c6b23ddb60ec966
SHA512 f6be0297bcfecc03b1309a984d45839c0e5ada10e75c707dbef16da777a3adb8bd42b12639ce7cde9d9ccb352f871b4b7623da2738c1c2852bac4fcc2e34702b
SSDEEP 6144:taKYsu0ULNbubfC0/2wYiY1+E+Wi73Cx8x0Sn+QOJ2FUJ1EqO3d12opWKoAte:oKY5VLNbV0+iY1l76SH8+XYFEEVNjpWx
MD5 SHA1 SHA512 SSDEEP

Password

infected

37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60
MD5 5fc3bd9632a02f189d81f75fc3b12ebf
SHA1 6abbc78a6fb421adf80051365dbfaff0b3fb696b
SHA512 cf0b9df6db5c85ebc85967dbfbdd99ada401f718445f69f258d9d0a9466f7b58a7bb2f1287cb5679988bd79b42807fa0e0e7fc419557f0af3fbb620b40b2c2af
SSDEEP 12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Chaos Ransomware
Detects command variations typically used by ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

878958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip

37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip

37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

mscoree

dotnet