chaos

General

Target

1.zip
Size

78KB
Sample

240418-tr7fwsae6x
MD5

daa45aae87cc8834a9888bd6e0a78710
SHA1

d15bbaa19f1a2836b6e1ad7f21fcc1bb9933723f
SHA256

cac13216f258b46462a963e984a57d0b34fe53cde02b8190a8afb5e9119a9ca0
SHA512

caeb0599289089cc92076577edbf790b5bdc6694e9e86f1dc30e56e360cea62baaf63480f26343eac35a665df701ce9ab49554a8975997aba182241aa61ea9aa
SSDEEP

1536:RBhbXvb8hoJrhUH2vOAeocNo6BRCV/7FHcWZvQRXRsrgKlmx3D:R3vTrdOAMo5pKXRwlG

Score

10^/10

Malware Config

Targets

- Target
  
  Antivirus.exe
- Size
  
  111KB
- MD5
  
  df1ce61fb4869963a1e95a917adef9d0
- SHA1
  
  bcf132651a5bd948e758441e4733519d1502c8bf
- SHA256
  
  e58bf0a81866c21e25dbe8f85fd74304259be3e1b53019f857c2354e23f71b1e
- SHA512
  
  d2867e1b00900098674f1a87653a9f016911649162c66f0eab67336f758a6611a497bc21a6cbe336bbc2464212bfec59e991b99aa92777ad2250e72b4e17888b
- SSDEEP
  
  3072:CB7q9NKEXUrQlGRSAMHsEwGYMl9AYGywOjvOjJ:CB7q9CQ8hMs7GpKPOaj
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (187) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  
  decryptor-decrypter/Decrypter.exe
- Size
  
  209KB
- MD5
  
  f30ce6004e05994ffd89124c5f0290df
- SHA1
  
  f797b573c65b1a0fe896fc529cb764da41617026
- SHA256
  
  00a48c79f453fa1b13c3f37feae3711c7ec35fd82b7bde2432d8c56ccdaf544d
- SHA512
  
  6eac7bc507b0a7398b9335a67cc1928b4161b11b3a96b9b025225671158945e5ec7df9fd56fd72b46864bd3267b7713a3e7ab12c83621d94c5cb81c7ffb46577
- SSDEEP
  
  768:8t4pOzzBogXuNuwHfMCwRhOF15utoSJYcyKkCep:8tvNogXuD//wCFLSXkC
Score

1^/10
behavioral3 behavioral4