chaos

General

Target

REDLINE_STEALER.exe
Size

289KB
Sample

240704-lcajlswfje
MD5

4a334b29a2f5f4caa8b69efe735b99c3
SHA1

9f43e471fd74ce2f1c41316d0cb73ca54cc6b629
SHA256

7fd0f9fc2fc543790514ee2ad137d546465c089aaef1e2c440a2b4cc3a10997c
SHA512

81a302429fc68a7f0650a48c1d6b446217b4354d46ebe3e44f4e70e849fec04ff41fefa366e1301dfd3cd8453c27a08a6b431022b180a1cd88906915c650e085
SSDEEP

6144:Z6r92dScRiDH6b/e8/8li3GXuE3y7ddtgx:BSSiDHe/d/8li3G+Ei7ddte

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\191719.README.txt

Ransom Note

All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $15. Payment can be made in Bitcoin only. In the event of non-payment, all files, passwords, and credit cards for all your accounts will be published online How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Contact us before paying to ensure decryption Telegram:t.me/Anon3621 Payment informationAmount: 0.000215749 BTC Bitcoin Address:3QEZdpib6bpy6443TJ6Sev9a1LzuKvwsYm

Targets

- Target
  
  REDLINE_STEALER.exe
- Size
  
  289KB
- MD5
  
  4a334b29a2f5f4caa8b69efe735b99c3
- SHA1
  
  9f43e471fd74ce2f1c41316d0cb73ca54cc6b629
- SHA256
  
  7fd0f9fc2fc543790514ee2ad137d546465c089aaef1e2c440a2b4cc3a10997c
- SHA512
  
  81a302429fc68a7f0650a48c1d6b446217b4354d46ebe3e44f4e70e849fec04ff41fefa366e1301dfd3cd8453c27a08a6b431022b180a1cd88906915c650e085
- SSDEEP
  
  6144:Z6r92dScRiDH6b/e8/8li3GXuE3y7ddtgx:BSSiDHe/d/8li3G+Ei7ddte
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2