Extracted

• • Target

    fe7c4b36fca4fdf53789979a4a09c880.exe

  • Size

    50KB

  • MD5

    fe7c4b36fca4fdf53789979a4a09c880

  • SHA1

    89caf7f3b9f4d7d732ade5593e1958f6f025afa1

  • SHA256

    1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470

  • SHA512

    e0668f6dfda991ab07870d53ce291f73d48533c44dfed1178c8b98b57c799eb77f19451bc70d09caaf757bf18ef6217b44e7fc626b38c89261dc8920796339f3

  • SSDEEP

    768:mDrJUAkwf3ppZuBdrm+KiPxWEh9HgPxWEjj4G:8rkwf3ppZRsPxZgPx94G

  Score

  10^/10

  chaosxwormzgratpersistenceransomwarerattrojanhermeticwiperbootkitupxwiper

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect HermeticWiper

    Detect HermeticWiper Payload.

    wiper

  • Detect Xworm Payload

  • Detect ZGRat V1

  • HermeticWiper

    HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.

    wiperhermeticwiper

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2