Extracted

• • Target

    1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470

  • Size

    50KB

  • MD5

    fe7c4b36fca4fdf53789979a4a09c880

  • SHA1

    89caf7f3b9f4d7d732ade5593e1958f6f025afa1

  • SHA256

    1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470

  • SHA512

    e0668f6dfda991ab07870d53ce291f73d48533c44dfed1178c8b98b57c799eb77f19451bc70d09caaf757bf18ef6217b44e7fc626b38c89261dc8920796339f3

  • SSDEEP

    768:mDrJUAkwf3ppZuBdrm+KiPxWEh9HgPxWEjj4G:8rkwf3ppZRsPxZgPx94G

  Score

  10^/10

  hermeticwiperxwormzgratpersistencerattrojanwiperchaospyinstallerransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect HermeticWiper

    Detect HermeticWiper Payload.

    wiper

  • Detect Xworm Payload

  • Detect ZGRat V1

  • HermeticWiper

    HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.

    wiperhermeticwiper

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops file in Drivers directory

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2