chaos

General

Target

Yashma ransomware builder v1.2.exe
Size

538KB
Sample

240624-mqk3ya1gjn
MD5

13e878ed7e547523cffc5728f6ba4190
SHA1

878ad3025f8ea6b61ad4521782035963b3675a52
SHA256

f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
SHA512

a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
SSDEEP

3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  Yashma ransomware builder v1.2.exe
- Size
  
  538KB
- MD5
  
  13e878ed7e547523cffc5728f6ba4190
- SHA1
  
  878ad3025f8ea6b61ad4521782035963b3675a52
- SHA256
  
  f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
- SHA512
  
  a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
- SSDEEP
  
  3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1