Extracted

• • Target

    ESET Crack.exe

  • Size

    381KB

  • MD5

    ad284d8e19e16bb34a12648c219eff2d

  • SHA1

    d5371b5cbc05c75548112b2ab42b47b4a695ac0a

  • SHA256

    7e620a991e554e89cfdb7ca4b131e237cd9936bd14ef48dc52872e0793415135

  • SHA512

    24ff90ba62bab82fab76bc5f748a4fc13708a484fdebdc6320f068b8fc42da8723c6e0253fab1752e1ed8c3de8bfcbd8850c7bb1d7be6cd02a88c03a0b4c4b00

  • SSDEEP

    6144:eB0r9q8EF+HSt/TRAfo7f4Zp3Ld61GN4SwNqEzf:e2EF+HS9TRAfo7f4ZpLc1GN4SwNqEzf

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (177) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2