chaos

General

Target

2024-04-15_eb9e582bba3727fe7c1ef9fcbb62b0d8_wannacry
Size

429KB
Sample

240415-md5xkscb69
MD5

eb9e582bba3727fe7c1ef9fcbb62b0d8
SHA1

40fc39892de1ae1408a4c3e53cf68aef802344b7
SHA256

40ff542ecff1ab1682cc5fb3c6cef640d94d89dd13f32837c533966c7f1ca392
SHA512

356e09c8c8093039bf51f751efd461a3865be8bd1e7529f86274cc0ae9146aae0485a051c0bd9fc6b2e7e887ebd3c0c0c37e6545c90a51ddf76ce06352076121
SSDEEP

12288:djR89QvWpMLNbzihksiRDEZgKgqViUVDWO6ocY2Fd8:djRAeihV8DopBtf

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

Hello! All of your files have been encrypted! Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $350. Payment can be made in Monero only. What happens if i don't pay? If you decide not to pay the ransom, All of your files and everything on your device will be released on the dark web for people to buy/view and will be deleted from your cumputer forever. This also goes for any other devices that are on your network (WIFI). How do I buy Monero/XMR? Look up a youtube video on how to buy the coin, or visit localmonero.co to buy from a seller. Payment Type: Monero/Xmr Coin Amount: $350 USD In Monero/XMR Monero/XMR address to send to: 45R284b7KTQaeM5t8A2fv61pDZG6PN2HE6qnV7CW6DsGbtCpgAN9F8qRjoppdY24gvV3dCKRExQ5FWS7wU1Fw8cSN6D1aFf

Targets

- Target
  
  2024-04-15_eb9e582bba3727fe7c1ef9fcbb62b0d8_wannacry
- Size
  
  429KB
- MD5
  
  eb9e582bba3727fe7c1ef9fcbb62b0d8
- SHA1
  
  40fc39892de1ae1408a4c3e53cf68aef802344b7
- SHA256
  
  40ff542ecff1ab1682cc5fb3c6cef640d94d89dd13f32837c533966c7f1ca392
- SHA512
  
  356e09c8c8093039bf51f751efd461a3865be8bd1e7529f86274cc0ae9146aae0485a051c0bd9fc6b2e7e887ebd3c0c0c37e6545c90a51ddf76ce06352076121
- SSDEEP
  
  12288:djR89QvWpMLNbzihksiRDEZgKgqViUVDWO6ocY2Fd8:djRAeihV8DopBtf
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2