chaos

General

Target

2024-04-29_80e864376faf7f9d0e0194b4d89d3ada_destroyer_wannacry
Size

27KB
Sample

240429-2g47sach62
MD5

80e864376faf7f9d0e0194b4d89d3ada
SHA1

7e926965d8ee74a3cd994e00ad52476dba4ecdcb
SHA256

fec363d4e55ca0ca5a42cf899ad0bcbde804d1ccaff35270cd841844e457d6d6
SHA512

0bc4d36e29a08bee1e9c0733358aae53e3e3644fd6f71d31ed2524149cb06a0ae4fcfd887b87be1f42ae4f8b4a312f6a9b53a06c22dc3e6ae4ca7d3dbafd5a68
SSDEEP

384:dLtWZPzzxAm1vp5FpqZsWfa2D6dzCkPMlFOy5o91bqxf82vm:dC7zxAmpUi2D7kMho9VqJ82e

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\manaware.exe

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-04-29_80e864376faf7f9d0e0194b4d89d3ada_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  80e864376faf7f9d0e0194b4d89d3ada
- SHA1
  
  7e926965d8ee74a3cd994e00ad52476dba4ecdcb
- SHA256
  
  fec363d4e55ca0ca5a42cf899ad0bcbde804d1ccaff35270cd841844e457d6d6
- SHA512
  
  0bc4d36e29a08bee1e9c0733358aae53e3e3644fd6f71d31ed2524149cb06a0ae4fcfd887b87be1f42ae4f8b4a312f6a9b53a06c22dc3e6ae4ca7d3dbafd5a68
- SSDEEP
  
  384:dLtWZPzzxAm1vp5FpqZsWfa2D6dzCkPMlFOy5o91bqxf82vm:dC7zxAmpUi2D7kMho9VqJ82e
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2