chaos

General

Target

Encrypter.vmp.exe
Size

6.6MB
Sample

240702-j6dr1steqc
MD5

09c4a597062486018955781571bf035e
SHA1

a4699c331aa48e58a21e864fe40aa0bc64e133bf
SHA256

c5b4eb6acef3b9b5eac756dac556b1f2cd78f093fcb080afc28fa035d3268120
SHA512

6b7f944864eb64e7ccfb72a37e631a647af389cd829fd05e15df0e5aca1a4d747205a002c6028dc21fbea3139fbc9a16629eb749772033d66dd3fb5a29523795
SSDEEP

98304:hUGZUP1EzfFwEaMy2/WNZaPJPu7255fEv1rIger8JkkDtHIhDDwUuUfgXzkn28lG:hZUt/ElyZsBuC3Wl5JkxDzfgXzqb5E

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note

----> You got ransom by FemboyCat <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Targets

- Target
  
  Encrypter.vmp.exe
- Size
  
  6.6MB
- MD5
  
  09c4a597062486018955781571bf035e
- SHA1
  
  a4699c331aa48e58a21e864fe40aa0bc64e133bf
- SHA256
  
  c5b4eb6acef3b9b5eac756dac556b1f2cd78f093fcb080afc28fa035d3268120
- SHA512
  
  6b7f944864eb64e7ccfb72a37e631a647af389cd829fd05e15df0e5aca1a4d747205a002c6028dc21fbea3139fbc9a16629eb749772033d66dd3fb5a29523795
- SSDEEP
  
  98304:hUGZUP1EzfFwEaMy2/WNZaPJPu7255fEv1rIger8JkkDtHIhDDwUuUfgXzkn28lG:hZUt/ElyZsBuC3Wl5JkxDzfgXzqb5E
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2