chaos

General

Target

2024-06-16_39606f25a795d1f1ae8d8a154780fab4_chaos_destroyer_wannacry
Size

27KB
Sample

240616-x4d7naxgkr
MD5

39606f25a795d1f1ae8d8a154780fab4
SHA1

bfda025d280b22371f987b702e94682b1c0b7ba6
SHA256

95b3dde51afe570553bd0f1ddba81a399532e33e5ac8979d64aaa9b009d071fb
SHA512

6ecbac36383230b6d1891f5992adef8a3cc295ca64ba19d7221c093904a0b2174577b51e75e048b7853e95d0e5e14b9aedf0e97486b9071457009e85cb0bd61a
SSDEEP

384:LtWZPzzxAm1vwePsd7lMDwXIYNl3Oy5o91s6x82vb:C7zxAmZsdweIAho92o82D

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-06-16_39606f25a795d1f1ae8d8a154780fab4_chaos_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  39606f25a795d1f1ae8d8a154780fab4
- SHA1
  
  bfda025d280b22371f987b702e94682b1c0b7ba6
- SHA256
  
  95b3dde51afe570553bd0f1ddba81a399532e33e5ac8979d64aaa9b009d071fb
- SHA512
  
  6ecbac36383230b6d1891f5992adef8a3cc295ca64ba19d7221c093904a0b2174577b51e75e048b7853e95d0e5e14b9aedf0e97486b9071457009e85cb0bd61a
- SSDEEP
  
  384:LtWZPzzxAm1vwePsd7lMDwXIYNl3Oy5o91s6x82vb:C7zxAmZsdweIAho92o82D
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (175) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2