chaos

General

Target

1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470
Size

50KB
Sample

240419-fvfkpaaf8y
MD5

fe7c4b36fca4fdf53789979a4a09c880
SHA1

89caf7f3b9f4d7d732ade5593e1958f6f025afa1
SHA256

1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470
SHA512

e0668f6dfda991ab07870d53ce291f73d48533c44dfed1178c8b98b57c799eb77f19451bc70d09caaf757bf18ef6217b44e7fc626b38c89261dc8920796339f3
SSDEEP

768:mDrJUAkwf3ppZuBdrm+KiPxWEh9HgPxWEjj4G:8rkwf3ppZRsPxZgPx94G

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

3.1

C2

gamemodz.duckdns.org:6969

Attributes

Install_directory
%AppData%
install_file
USB.exe

Targets

- Target
  
  1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470
- Size
  
  50KB
- MD5
  
  fe7c4b36fca4fdf53789979a4a09c880
- SHA1
  
  89caf7f3b9f4d7d732ade5593e1958f6f025afa1
- SHA256
  
  1b3711717d430ce33222b97fe8ec692741b7ac8bd9bfb4c2c975ae2f46b37470
- SHA512
  
  e0668f6dfda991ab07870d53ce291f73d48533c44dfed1178c8b98b57c799eb77f19451bc70d09caaf757bf18ef6217b44e7fc626b38c89261dc8920796339f3
- SSDEEP
  
  768:mDrJUAkwf3ppZuBdrm+KiPxWEh9HgPxWEjj4G:8rkwf3ppZRsPxZgPx94G
Score

10^/10

hermeticwiper xworm zgrat persistence rat trojan wiper chaos pyinstaller ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Detect HermeticWiper
  Detect HermeticWiper Payload.
  wiper
- Detect Xworm Payload
- Detect ZGRat V1
- HermeticWiper
  HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
  wiper hermeticwiper
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
behavioral1 behavioral2