chaos

General

Target

bow.exe
Size

22KB
Sample

240423-29ht9acf7w
MD5

9c521c4bc50477b65e51b8c027779b57
SHA1

e9f86154e35c597957be6a47e04ec3f8ca355081
SHA256

001b2843e0af153d71b373962b2c0cf431cf1177b86be8be372717d620495640
SHA512

bf8e44e139fe0c44e47ac182f736e02f0d28222a254883e9e9de6c737ebe1eff5216ea7efdddd1a6b59b06065a7a7afb4f39d7bfda46697b9d67e7aa924335d8
SSDEEP

384:J3MLWHn3kI3fkS0YYpAVgjuxJ3r91CrMbYxPe8:pn3kIcBpAmjC3r9SMbme8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note

All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is 50$. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.00075000 BTC Bitcoin Address: bc1qtatuanl0ux447zgmgkz0u0plkdu6wpcqwprweg

Targets

- Target
  
  bow.exe
- Size
  
  22KB
- MD5
  
  9c521c4bc50477b65e51b8c027779b57
- SHA1
  
  e9f86154e35c597957be6a47e04ec3f8ca355081
- SHA256
  
  001b2843e0af153d71b373962b2c0cf431cf1177b86be8be372717d620495640
- SHA512
  
  bf8e44e139fe0c44e47ac182f736e02f0d28222a254883e9e9de6c737ebe1eff5216ea7efdddd1a6b59b06065a7a7afb4f39d7bfda46697b9d67e7aa924335d8
- SSDEEP
  
  384:J3MLWHn3kI3fkS0YYpAVgjuxJ3r91CrMbYxPe8:pn3kIcBpAmjC3r9SMbme8
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1