chaos

General

Target

2024-04-22_2b11872b7e3ddc4e96682e597e406ac8_destroyer_wannacry
Size

27KB
Sample

240422-x5n39afb61
MD5

2b11872b7e3ddc4e96682e597e406ac8
SHA1

5f045aa9c4a5c46b96a85f5c382d33427e98b4cf
SHA256

df5a7564ad18463b2dafc86631ae4a120423a17efc32977532b41aac6b83febf
SHA512

19d6dc254d0bb54d42a0cc11e861fa2e0fd69793a3e8f67332d8f6d8debb9a88c808c3bca4dd8caa2c5c21c9b5c1c182d97ab64c08c0c62ac8c186d64a201269
SSDEEP

384:xtWZPzzxAm1vFzaGh2r7OUmgFRYfdQPyRlZOy5o91Tecv82v4:47zxAmuGUrEgnYwWho95eI82w

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our Telgram :@katerose042 ( In case of no answer in 24 hours check your spam folder or write us to this : @katerose042) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. Adress : 1FcQuP9kvbQDuvwFxj6aguLBVvnfwbv5R2 After payment we will send you the tool that will decrypt all your files.)

Wallets

1FcQuP9kvbQDuvwFxj6aguLBVvnfwbv5R2

Targets

- Target
  
  2024-04-22_2b11872b7e3ddc4e96682e597e406ac8_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  2b11872b7e3ddc4e96682e597e406ac8
- SHA1
  
  5f045aa9c4a5c46b96a85f5c382d33427e98b4cf
- SHA256
  
  df5a7564ad18463b2dafc86631ae4a120423a17efc32977532b41aac6b83febf
- SHA512
  
  19d6dc254d0bb54d42a0cc11e861fa2e0fd69793a3e8f67332d8f6d8debb9a88c808c3bca4dd8caa2c5c21c9b5c1c182d97ab64c08c0c62ac8c186d64a201269
- SSDEEP
  
  384:xtWZPzzxAm1vFzaGh2r7OUmgFRYfdQPyRlZOy5o91Tecv82v4:47zxAmuGUrEgnYwWho95eI82w
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2