chaos

General

Target

225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.zip
Size

7.1MB
Sample

240508-bc4gkscf59
MD5

2069b44deb266f45048d9142d648097b
SHA1

a3f94d8f5d430d70173cd46c64f0596454e0160f
SHA256

d76ecb65d7444d3a7bef1775797175d6ee1df6274668a8a82af18517af89b2ba
SHA512

646bb8849d037b3df3d31c0192b5497a9ae94f34ed39b80ac094531be905b8932f9ff4365af8b80d18795680465f62e320468de2323764ca86f0cac9aee3777d
SSDEEP

196608:vqPW81TSW8TpgdQ7a47zSR26PQU8rCNiAj:e1TygdQ+TM6PQ70

Score

10^/10

Malware Config

Targets

- Target
  
  225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892
- Size
  
  7.3MB
- MD5
  
  127e33cd08a5724cd7bd7dc4f46a1841
- SHA1
  
  a0714754df75daced14a9a01d6d3e1e840e4a809
- SHA256
  
  225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892
- SHA512
  
  24d88403399a1a03e60a3aa30978c05f997e724aeffa66a3856660732bb834869c82696363bf87190a9ed53ff25fdee4b9bf49d4a5deda4ba528d737f42446a9
- SSDEEP
  
  196608:4lRSxbAQ5owejuJDUX47dwdW0LBOTnPHh8Fp+:/xCaUX47d4sy3+
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (178) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2