Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe

  • Size

    1.3MB

  • MD5

    ffce3f25a125b5dfcd96e92148b7d209

  • SHA1

    a4c2bfa23b98471ac1ea7103e194cf6488a058ac

  • SHA256

    020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c

  • SHA512

    7d0af9214e4cdabceab9abb2586288e0a42ef9b7a7abc1bc7f03c04cf48b6722eeeee4a476aaf2567feaacbc70fb3e6bf36aa1050b010ef68019b7e80886f823

  • SSDEEP

    24576:1pa1z++i/OfNbXirk1nF1qfWk3w80geAcVW9CFnBOmp7BCr/otH5LSp+7I80w:zF+BZk6FnBOmp7BCr/G7I80

  Score

  10^/10

  defense_evasionevasionexecutionimpactransomwaretrojan

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (172) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1

• • Target

    06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe

  • Size

    147KB

  • MD5

    ce4c09c4b836c31993e902adf115a54a

  • SHA1

    5fe984d96c4361a996c898e93dd72538614ca0c6

  • SHA256

    06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8

  • SHA512

    02226e2abb6616525a2431ce6f4d6c81d54d2c06f7cf4f5cb8af740b14e03df657e8fa22e71d8b83ab7e1cdb9b943868f7d3d687482b499d85b2ca7974f0140d

  • SSDEEP

    3072:ribQR54LZPhG1tqIFMH4zGrEV9SzjS3vqY:riI6PhGqI+YqrEV9S2q

  Score

  9^/10

  defense_evasionexecutionimpactpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral2

• • Target

    083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe

  • Size

    353KB

  • MD5

    c525eb716420dc915fe574b8a3973143

  • SHA1

    b272f9a63aed4c5ab06e887d3ceb9854f52fa1d7

  • SHA256

    083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb

  • SHA512

    24ba34d78e5c295c740e2ec9d0c27c90a25dcad5f330c72929c9e98a64f36f8ab6763c7f9929bc72a31d9b52d11ab17882a3841a75b77b904f4aeb90c768177d

  • SSDEEP

    6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnqyk:WeUjNHCFkw3OCMpxcXiPoKN

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3

• • Target

    15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

  • Size

    213KB

  • MD5

    3271867f57a7ddd53d2f36210f79b241

  • SHA1

    04ccf49f32406c6a0d61745bae090a9426a1500d

  • SHA256

    15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f

  • SHA512

    a0a0725b6023cab53363303db4aa0c6c1c1916a6b178b1f3a6301e779c67a2b1d68202a696ee328ffa9080f2f7236f581cbf8aadef4eadebb748ed6fcf35baa9

  • SSDEEP

    3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq

  Score

  9^/10

  defense_evasionexecutionimpactpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (153) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral4

• • Target

    22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe

  • Size

    240KB

  • MD5

    598b2a2bdfb474047a6d5b5f0469c27a

  • SHA1

    a2d42ceb046e3bfcab1bb3dc9ef9e89f12e2bd66

  • SHA256

    22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585

  • SHA512

    ff6930e0dd15d7fc23f3cd62b5213863ec0c59b8ada189960e52be1832c8a1b928ddb3debf9eca65bbd5203e7b191e55d79dd2c7592bed3e197bdfb5b200ddbf

  • SSDEEP

    3072:PC4zn72NrvV9YhZv0FKbgx2HMdYlTYpu/EVarwBwCc45TEywugt45ZoIWpEzGVz1:Pn72NrvV9OCTE45Z1WpEKvmSx7ri

  Score

  9^/10

  persistenceransomware

  • Renames multiple (150) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral5

• • Target

    24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe

  • Size

    88KB

  • MD5

    e60df2922d5ceb45856f405e41a9d6cc

  • SHA1

    2e438348f4ec2fbd82ce944ad3697d58771ac170

  • SHA256

    24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d

  • SHA512

    21eac0c509698b0b257e0f8b304204b0f29bbca8f0fafbb33aee5d93af727859ec6e2977c45c658248858cbe362ee5438c37bf566c269e4b708a89f22c87cca3

  • SSDEEP

    768:/qo23p8xAcr9G5eH2SU2Ip4jBqltCF0AxEjenoB69+Fx:yo2iAcr9GYH2SFHBWAxEjc+

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (213) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral6

• • Target

    27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe

  • Size

    352KB

  • MD5

    b431bf2649aee55b729f1668a7bc4b12

  • SHA1

    f618c191798cd8a809120bbf6b09ff79d8877138

  • SHA256

    27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6

  • SHA512

    b31ac84b8d41c4d77536763acf3daa75c437b62e792329f232892e7939b35ed8731f3aaaa3e406cf1bf6121a64c920dd03df4da07847debdd2caae3dc70ed544

  • SSDEEP

    3072:L3kLEir9ihicEQ23lcjxXedA3MYRjuOGK2OIcVtkzuwOYHYHYN4YHYHYcSuCexyM:Ur9ikcL2mj4d6riOZ+qSHej/Kd+bN

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7

• • Target

    2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe

  • Size

    4.2MB

  • MD5

    4755656e64a4cb4ee7ae5846acc1bbc1

  • SHA1

    fd8f5007141ac941fcac77c6565ccb1ec86b1391

  • SHA256

    2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d

  • SHA512

    6aecc49f717d19425256ef0dcfe5ee8fdd47e131d91322ef8f250d92935d55130226227e0a5f8d8a1d94f1a8f31c4325f026755610a15717a05df26a4c498af5

  • SSDEEP

    98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulur:ovsJR0TW6yiIKRhzqOsr

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral8

• • Target

    2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe

  • Size

    283KB

  • MD5

    f5a0c315b535c5a65bbbad8352592221

  • SHA1

    97e4cff4bece35cbcea863045025645f931fce14

  • SHA256

    2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1

  • SHA512

    58560e1f409fb5cbd70517594d47d2e6145b17d3e64170ef6c1ae583cdf59fe670c2f1c468733ecca0a99c8ec893426a6ca9a8263be12a8845e87af3be50d335

  • SSDEEP

    3072:4W2W9AU+AUae0RgBhr2TLJY74vSePjxi4vLE3YKFcLhNLUt/sVZuQ5kROFz8C9uk:4jW9/+AGBOLS4cvIpNYqa6kIFzn9/x

  Score

  10^/10

  chaospersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral9

• • Target

    2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe

  • Size

    241KB

  • MD5

    692ea33f6b08ccd47ef8a4f8b913fc4f

  • SHA1

    8a2f0c6b5f422cb2125273be1eece261aa3007e0

  • SHA256

    2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6

  • SHA512

    df87964befe8dad825e869e4d915c46d71bb72b4f318f9c52d9a1381d391bad73aef5e555057e8189dca479359fa635b19727bb64d1876c1403057ed1e1faca7

  • SSDEEP

    3072:aoT9szr954q4qf8NWPr0Dp/XpoO1zDsJOFQVrFsUBTa488+6WniGxfLwxhqSEaqw:0r95wCPADpaOOwajTa65HyigEX1OeLn

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10

• • Target

    2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe

  • Size

    2.4MB

  • MD5

    42935359d9ae5ab7507f082c117c0027

  • SHA1

    05dd7616805833497c0ec1826ffc53b7673d8191

  • SHA256

    2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421

  • SHA512

    f7fb318258fd7faaed95facea3b8c1ee2c11c13cb5ea239773b22ae5e270cef94a1892dfd2f60df15cf79f9f4935e4145bf5127734ff8893c3020c245d18189a

  • SSDEEP

    12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCH:eEtl9mRda12sX7hKB8NIyXbacAfk

  Score

  10^/10

  persistence

  • Modifies WinLogon for persistence

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral11

• • Target

    37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe

  • Size

    953KB

  • MD5

    5fc3bd9632a02f189d81f75fc3b12ebf

  • SHA1

    6abbc78a6fb421adf80051365dbfaff0b3fb696b

  • SHA256

    37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

  • SHA512

    cf0b9df6db5c85ebc85967dbfbdd99ada401f718445f69f258d9d0a9466f7b58a7bb2f1287cb5679988bd79b42807fa0e0e7fc419557f0af3fbb620b40b2c2af

  • SSDEEP

    12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Renames multiple (205) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral12

• • Target

    38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe

  • Size

    1.9MB

  • MD5

    d28e88e6e9ad654f81909e605f3398c1

  • SHA1

    84726882c606eec6b7ed7d0ba1d9acdd13390e45

  • SHA256

    38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c

  • SHA512

    3e971529338ef0576ce40679b33fb763b2e1f3e7c16255b922434baf486d6569ee1e0770959ba7763b9759d89bf55b149d54546bdfa7299c41fd2c5d302ecaf7

  • SSDEEP

    24576:tnxLSUXY7WSIGgjvvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZDv1xim+y6HLOO3

  Score

  9^/10

  discoveryexploitpersistenceransomwarespywarestealer

  • Renames multiple (8656) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Possible privilege escalation attempt

    exploit

  • Deletes itself

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral13

• • Target

    3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe

  • Size

    6.3MB

  • MD5

    6a7b2c486baa38a1d89e10889fc0802b

  • SHA1

    6b8ddf08972160a12e144e00aa8a486b3c35e5e1

  • SHA256

    3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096

  • SHA512

    a1d60b7113fea5c71309cb2bf49758802f73c5c8152030b7376d8ae2eb7c87d117fdb72b29f73e11c9cbc3ed17ef68a856ce56ed3d93fe4143f9085fd191f739

  • SSDEEP

    98304:RfrQZerQZ2cK5YOXwnS4rV340Jy9+lG498HL:Rfr2er22KIJZr

  Score

  1^/10
  behavioral14

• • Target

    49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe

  • Size

    2.8MB

  • MD5

    4431e8c03162a470cc1c74edfded4afb

  • SHA1

    1fdd90a0a702447aebbd683e175c85a50acb9715

  • SHA256

    49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b

  • SHA512

    f006cab8488dc669b5d23e64eea14efce8f6c90cd1ab57b71967e9ecb1748f57da2d5d6bf7eb824338b6025346abd823391abb2932e9d2eb719d55404f565922

  • SSDEEP

    24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEC+:BSy6PX3PpM+P5IdF+

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral15

• • Target

    4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe

  • Size

    390KB

  • MD5

    8c64181ff0dc12c87e443aae94bf6650

  • SHA1

    e91d7ebd17912785caa3e71ef1571dc01b1cd854

  • SHA256

    4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5

  • SHA512

    4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17

  • SSDEEP

    12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa

  Score

  10^/10

  mimikatzbootkitpersistencespywarestealer

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral16

• • Target

    4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe

  • Size

    2.6MB

  • MD5

    ca1e56a26f9b7b8e18a5f627bd946d53

  • SHA1

    80f9a9afa9a115acabd32ddbd0339a17d261e90c

  • SHA256

    4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a

  • SHA512

    d48549c184754f7d7e3c5b35c14aab50766aaa00eb8ce62d326a44ce9ccfc0b40bc94e33fa00c8b7594dfc0585f0c6530597d1222d8cb03edcb701de203af679

  • SSDEEP

    12288:jOU/d7WQvyPWa4DQFu/U3buRKlemZ9DnGAevjdMOU/d7WQvyPWa4DQFu/U3buRKO:7/JRyuN5e/JRyuN

  Score

  10^/10

  zeppelinransomware

  • Detects Zeppelin payload

  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  behavioral17

• • Target

    4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe

  • Size

    2.8MB

  • MD5

    aa5c75d313a98f3284d7ef52236d2d46

  • SHA1

    085b7906df9bb7c07b254e9f1dd3c1015b581d8b

  • SHA256

    4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168

  • SHA512

    0302c54bc87cc38f28e7d3b428fc51256f828831501e341e720e9b477d24241071e402675fc6e73d12daf4917f25a874a4a4b614f15b12d8d7be210e15ea19ac

  • SSDEEP

    24576:WS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEgl:WSy6PX3PpM+P5Idtl

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral18

• • Target

    5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe

  • Size

    25KB

  • MD5

    d2623fa5d0ce3b4746b1803caed0fdf6

  • SHA1

    339883e34e0cbc23f4c7a6ddb2376b420066fa1f

  • SHA256

    5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7

  • SHA512

    3140427772552c53ceafa9f745f6349f170401d6b3ae72d641d3004b5b4cfca82b04c30e6734f1b1fec97dcdbc452a36d2ffca4a014eb5851ea2c0f6bf4969f7

  • SSDEEP

    384:a3MLWHn3kI3fcSxlR2WpOYsBNakQJgr91Czxb5fe6uaVyZK:+n3kIE69pCYgr9ixbZe6PVyk

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral19

• • Target

    67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe

  • Size

    2.0MB

  • MD5

    eba1ad16bc2fa284adae07cbebef8f7f

  • SHA1

    225163dfd08838ae6bfec6e27994b92955013576

  • SHA256

    67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478

  • SHA512

    909a8663ee28f43e7737f36707ee1a0195cd73e441dc4d2e6497d6bd7dad67465e21cdb0dd0e07511313673c1f8847c7a85966876165d197566dbbae8f34459b

  • SSDEEP

    49152:iFOLMMFExN0CZb979qfWqcWMT2I9tH2gpNcjsUnlww3GJIV4p:gOIMqvTF9qf5cWMT99tH2s4sUnKoo

  Score

  3^/10
  behavioral20

• • Target

    6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe

  • Size

    145KB

  • MD5

    9f16d35de8c312ba0b6f9efd558487fe

  • SHA1

    93040ad968110a6c96c9e2f74f6902aa52b71057

  • SHA256

    6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e

  • SHA512

    1534d12e38937d0c9597f67540b1c849728a637eb7dcd1286e28c9bd72a463bdbc492247beffd16e47986157323134edc84eb1d1f2e857d5c4a136427fe99699

  • SSDEEP

    1536:6Cpb2XbbPD1c2lB4a9wL7vkYq0Hk5rR5JkVJ4y/uU/rLV9YYccquTrX7YeOzk+7J:ZyXbt4aEcTrR5OVZ/rLV9Yrcqu3

  Score

  7^/10

  persistenceransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral21

• • Target

    6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe

  • Size

    6.0MB

  • MD5

    7f97b34a113170d02ff8008c2bbc7745

  • SHA1

    fe00b8cfc0896d6d23ff3628af8c406a7683d707

  • SHA256

    6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe

  • SHA512

    a899eb8481c02d0c983c7761ca9962ffdea22354cdef6cefeadbdf0ac96d43a54c02ea72e89b8b5c2bdefed38ecdd960a8d267e3fc15545286844baf40ac9e93

  • SSDEEP

    49152:LwLwHt4Ihqew+96PoBjYs5ngToDEZwTFgN+1TtI1VjFF3PBTqJQkYUjeAb3WUpPb:L9fhqezRobVjFyEUqA6Sp+ZIogCxfwis

  Score

  10^/10

  gandcrabbackdoorransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  behavioral22

• • Target

    75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe

  • Size

    2.7MB

  • MD5

    024f23eff975f6989dd2dc4340886961

  • SHA1

    d553862c0cb3ab3ad5cba7654c038c966ebc9a00

  • SHA256

    75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734

  • SHA512

    4c62ebc36cca4ef4ff9d59e8497047436a7f9f51d78d9dc6d29a657052b997479378d46fc5616150bc62cb7211e623c2012fdd7cca2b4e96f54e64d61975e98a

  • SSDEEP

    24576:s1S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:s1Sy6PX3PpM+P5Id

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral23

• • Target

    82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe

  • Size

    270KB

  • MD5

    14ea366be5cb691078be2c302590f435

  • SHA1

    84e562bb99249a58849f6f82b29a7746dd144900

  • SHA256

    82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a

  • SHA512

    9be5097295010fa04e04fcae578b19ab43935b09a70d8b31a038fd1ef7ed89dcd9143b82400e8d31913bf32a7a18628557dfaa1f4d37c1e7c8062d7a7368afb9

  • SSDEEP

    6144:r02q9t3hysg2+00aHYHjdCoD5oa+S/dIm:Aj3hBg/00aHYDd3DCO/dI

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral24

• • Target

    8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe

  • Size

    604KB

  • MD5

    697deef7b2ca6b79c3608ebdf9c70977

  • SHA1

    64fb76029f4d7b3aa06646f286182daf4de2a27a

  • SHA256

    8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347

  • SHA512

    18870c02d0193349748447d92eb1fd2540ad02d54b736e9ce42dbe275acee5cbaa09d4f95e188a94d29e69f9349ff0bbe60e937880a867d4573847d93f7b2f8e

  • SSDEEP

    12288:/g1YsKMSiS9SW35dmhqoeBsGJGKlOD4BZXu3lKG3pHLb4:/gd5QSW3rQqoeBsGJGTyG3JLk

  Score

  10^/10

  ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral25

• • Target

    8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe

  • Size

    2.8MB

  • MD5

    7db89ef8195831eb737b0a13cfbd8c60

  • SHA1

    3c8d54c374bda8cc955cfc7477f9e385f24e9592

  • SHA256

    8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd

  • SHA512

    537ce51e4351fdd8fed8a1cc3e497097847bd84c1d7e058d6e5672c1cc419cbdfb98c5af822af167fff2761127a33070fc65f2f724116cca206b56b3e8df267f

  • SSDEEP

    24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEzQ:BSy6PX3PpM+P5IdYQ

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral26

• • Target

    8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe

  • Size

    3.3MB

  • MD5

    acd46f88a6f90143090c342c10544ccf

  • SHA1

    bb90bed3b0d747feeac32536d75c6d153b34be0b

  • SHA256

    8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c

  • SHA512

    82e91a14b2a7bfb659a566df7caf7f8dc28b61a14c504dd6ca23166ff2bb142114a43c5a3c70309022d813f34fb3aa63d321d964f3b6178e42b650ac0e56e84f

  • SSDEEP

    24576:v54IAnWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKI:CIAWjdAp1PagjLuSh3i+FtvkMzT+

  Score

  10^/10

  mafiaware666ransomware

  • Detect MafiaWare666 ransomware

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Renames multiple (382) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops desktop.ini file(s)

  behavioral27

• • Target

    8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe

  • Size

    128KB

  • MD5

    85db480564216a2842299723f2537f57

  • SHA1

    97f5a29bb43312689de4c043dbea6a424319f407

  • SHA256

    8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720

  • SHA512

    c413c3c7dd57abacf2ea431127ddbb89884604dcbcf0a34f74de6b78dc30036602b0c36300eda1169470583a02bd34abf0371a12a6791c300fef0154fe6708c0

  • SSDEEP

    768:8Jqo2zIpszlgqr91OC/ehhegFH4MkaL5PEs:8co21lgqr91OzhvH4QL5cs

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (210) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral28

• • Target

    8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe

  • Size

    131KB

  • MD5

    807b3c16e4b836511f326750bd175189

  • SHA1

    b24792703c3f05e07a668b4c1b701799b7e6fb6b

  • SHA256

    8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c

  • SHA512

    844c26ecc56929ca444344d22265e6e02debe1713c99a732c80cbee3474852b48aa359567a1e3e78cc165441177dd9f8880b8213806d69aac0e8df4352cf969b

  • SSDEEP

    3072:KFk4WBCsljJ8lSATxHt2bFZQhdFC7UtrK:KFkNCstGwATxN2bkFC

  Score

  10^/10

  evasionexecutionpersistenceransomware

  • Disables service(s)

    evasionexecution

  • Renames multiple (51) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Modifies WinLogon

    persistence
  behavioral29

• • Target

    8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

  • Size

    353KB

  • MD5

    74236c89b9fcb1194bcf19cf5920f3e3

  • SHA1

    7954ff64d20eae792a36ca2cf10a17da35cfbf27

  • SHA256

    8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7

  • SHA512

    fbf08ee1017ec6a497a468a5fcfb618bddab57b9bf087f1d478187410458e3922e9d48e9bb872098a0a912bcd3c096c11075ba8142df64cf3cdaaa833504ad83

  • SSDEEP

    6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnq9Bx:WeUjNHCFkw3OCMpxcXiPoK9

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral30

• • Target

    9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe

  • Size

    976KB

  • MD5

    52e77b6c313dccdf3e013b86a8cdd915

  • SHA1

    72051bf592b4da79b44d704b675a810ad387a549

  • SHA256

    9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275

  • SHA512

    7a9e397af4f1963e742c1125e55c9808b1e90b077c98be374638d06bccce2106e6c436e4629b6a5233f22adc451a9f351b99a8f45a2a86802a0d21c73860b4da

  • SSDEEP

    12288:hUFOlD+3ryYy5zOuMEXyfrznawAmcCh7axyK9E3+ez2pSqxnBPrAM+zwbRU3i+yF:/a0rbpZ7mi+y

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral31

• • Target

    9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe

  • Size

    164KB

  • MD5

    44f3a9311b23d84f336cc5b856f16682

  • SHA1

    45e9f3c9836926822d4164848dad0dc6d5fd22d5

  • SHA256

    9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920

  • SHA512

    858d16972a6fece4dd3a30b77f7415433c994a4edaa0064282b5f2b2027d8d0d31e21ac66583e270d7c0cfc42d1bd56cdd506fdf86d67994c78275be58282f6b

  • SSDEEP

    3072:k3kw4Rlr9i0uIYGSKrG8yaJYCZWKuzfo5dXuZRodZXJvPbtH:64Pr9i00GrtUwJj1hH

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral32