chaos

General

Target

jjj.bin
Size

23KB
Sample

240414-dwlf8agh2t
MD5

042af9c511552255aed26954d500543c
SHA1

e478b331aec1166f16a714e2a4320fcb04d54b16
SHA256

b69bb28aa423914139a3edcf9fdb617f3105d971e628c4cd82bbd62b9fc32b85
SHA512

5729179cce14e135b9e9d79d1acf4e518f2eadff604e5094e9f1eaf9e8c2ef9a3ada18905c55143fe2bbeaf020f3cff3b7e7e9b0845475353fff286a0cefa664
SSDEEP

384:R3Mg/bqo2i5rMfpz0qjuwzUrJXmr91C221gYei:Tqo2Ir8pzRjKd2r9t2xei

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\READ_IT.txt

Ransom Note

[ Oops, Your files have been encrypted! ] WHAT HAPPENED TO MY COMPUTER? Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption key. The ransomware also spread in your Network or USB, You cannot kill or remove the ransomware You can recover your files unless you pay ₱2000 in our GCASH provider and after you send to the designated number with a receipt. You can send it to our email GCASH - https://ibb.co/RHs43WH Email - [email protected]

Emails

[email protected]

URLs

https://ibb.co/RHs43WH

Targets

- Target
  
  jjj.bin
- Size
  
  23KB
- MD5
  
  042af9c511552255aed26954d500543c
- SHA1
  
  e478b331aec1166f16a714e2a4320fcb04d54b16
- SHA256
  
  b69bb28aa423914139a3edcf9fdb617f3105d971e628c4cd82bbd62b9fc32b85
- SHA512
  
  5729179cce14e135b9e9d79d1acf4e518f2eadff604e5094e9f1eaf9e8c2ef9a3ada18905c55143fe2bbeaf020f3cff3b7e7e9b0845475353fff286a0cefa664
- SSDEEP
  
  384:R3Mg/bqo2i5rMfpz0qjuwzUrJXmr91C221gYei:Tqo2Ir8pzRjKd2r9t2xei
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2