Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe
  • Size 1.3MB
  • SHA256 020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c
  • MD5 ffce3f25a125b5dfcd96e92148b7d209
  • SHA1 a4c2bfa23b98471ac1ea7103e194cf6488a058ac
  • SHA512 7d0af9214e4cdabceab9abb2586288e0a42ef9b7a7abc1bc7f03c04cf48b6722eeeee4a476aaf2567feaacbc70fb3e6bf36aa1050b010ef68019b7e80886f823
  • SSDEEP 24576:1pa1z++i/OfNbXirk1nF1qfWk3w80geAcVW9CFnBOmp7BCr/otH5LSp+7I80w:zF+BZk6FnBOmp7BCr/G7I80
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionevasionexecutionimpactransomwaretrojan

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (237) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1
• • Target
    06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
  • Size 147KB
  • SHA256 06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8
  • MD5 ce4c09c4b836c31993e902adf115a54a
  • SHA1 5fe984d96c4361a996c898e93dd72538614ca0c6
  • SHA512 02226e2abb6616525a2431ce6f4d6c81d54d2c06f7cf4f5cb8af740b14e03df657e8fa22e71d8b83ab7e1cdb9b943868f7d3d687482b499d85b2ca7974f0140d
  • SSDEEP 3072:ribQR54LZPhG1tqIFMH4zGrEV9SzjS3vqY:riI6PhGqI+YqrEV9S2q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  defense_evasionexecutionimpactpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence
  behavioral2
• • Target
    083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe
  • Size 353KB
  • SHA256 083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb
  • MD5 c525eb716420dc915fe574b8a3973143
  • SHA1 b272f9a63aed4c5ab06e887d3ceb9854f52fa1d7
  • SHA512 24ba34d78e5c295c740e2ec9d0c27c90a25dcad5f330c72929c9e98a64f36f8ab6763c7f9929bc72a31d9b52d11ab17882a3841a75b77b904f4aeb90c768177d
  • SSDEEP 6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnqyk:WeUjNHCFkw3OCMpxcXiPoKN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Stops running service(s)

    evasionexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3
• • Target
    15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
  • Size 213KB
  • SHA256 15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f
  • MD5 3271867f57a7ddd53d2f36210f79b241
  • SHA1 04ccf49f32406c6a0d61745bae090a9426a1500d
  • SHA512 a0a0725b6023cab53363303db4aa0c6c1c1916a6b178b1f3a6301e779c67a2b1d68202a696ee328ffa9080f2f7236f581cbf8aadef4eadebb748ed6fcf35baa9
  • SSDEEP 3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  defense_evasionexecutionimpactpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (111) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral4
• • Target
    22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe
  • Size 240KB
  • SHA256 22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585
  • MD5 598b2a2bdfb474047a6d5b5f0469c27a
  • SHA1 a2d42ceb046e3bfcab1bb3dc9ef9e89f12e2bd66
  • SHA512 ff6930e0dd15d7fc23f3cd62b5213863ec0c59b8ada189960e52be1832c8a1b928ddb3debf9eca65bbd5203e7b191e55d79dd2c7592bed3e197bdfb5b200ddbf
  • SSDEEP 3072:PC4zn72NrvV9YhZv0FKbgx2HMdYlTYpu/EVarwBwCc45TEywugt45ZoIWpEzGVz1:Pn72NrvV9OCTE45Z1WpEKvmSx7ri
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  persistenceransomware

  • Renames multiple (145) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral5
• • Target
    24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe
  • Size 88KB
  • SHA256 24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d
  • MD5 e60df2922d5ceb45856f405e41a9d6cc
  • SHA1 2e438348f4ec2fbd82ce944ad3697d58771ac170
  • SHA512 21eac0c509698b0b257e0f8b304204b0f29bbca8f0fafbb33aee5d93af727859ec6e2977c45c658248858cbe362ee5438c37bf566c269e4b708a89f22c87cca3
  • SSDEEP 768:/qo23p8xAcr9G5eH2SU2Ip4jBqltCF0AxEjenoB69+Fx:yo2iAcr9GYH2SFHBWAxEjc+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (208) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral6
• • Target
    27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe
  • Size 352KB
  • SHA256 27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6
  • MD5 b431bf2649aee55b729f1668a7bc4b12
  • SHA1 f618c191798cd8a809120bbf6b09ff79d8877138
  • SHA512 b31ac84b8d41c4d77536763acf3daa75c437b62e792329f232892e7939b35ed8731f3aaaa3e406cf1bf6121a64c920dd03df4da07847debdd2caae3dc70ed544
  • SSDEEP 3072:L3kLEir9ihicEQ23lcjxXedA3MYRjuOGK2OIcVtkzuwOYHYHYN4YHYHYcSuCexyM:Ur9ikcL2mj4d6riOZ+qSHej/Kd+bN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7
• • Target
    2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
  • Size 4.2MB
  • SHA256 2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d
  • MD5 4755656e64a4cb4ee7ae5846acc1bbc1
  • SHA1 fd8f5007141ac941fcac77c6565ccb1ec86b1391
  • SHA512 6aecc49f717d19425256ef0dcfe5ee8fdd47e131d91322ef8f250d92935d55130226227e0a5f8d8a1d94f1a8f31c4325f026755610a15717a05df26a4c498af5
  • SSDEEP 98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulur:ovsJR0TW6yiIKRhzqOsr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral8
• • Target
    2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe
  • Size 283KB
  • SHA256 2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1
  • MD5 f5a0c315b535c5a65bbbad8352592221
  • SHA1 97e4cff4bece35cbcea863045025645f931fce14
  • SHA512 58560e1f409fb5cbd70517594d47d2e6145b17d3e64170ef6c1ae583cdf59fe670c2f1c468733ecca0a99c8ec893426a6ca9a8263be12a8845e87af3be50d335
  • SSDEEP 3072:4W2W9AU+AUae0RgBhr2TLJY74vSePjxi4vLE3YKFcLhNLUt/sVZuQ5kROFz8C9uk:4jW9/+AGBOLS4cvIpNYqa6kIFzn9/x
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaospersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral9
• • Target
    2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe
  • Size 241KB
  • SHA256 2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6
  • MD5 692ea33f6b08ccd47ef8a4f8b913fc4f
  • SHA1 8a2f0c6b5f422cb2125273be1eece261aa3007e0
  • SHA512 df87964befe8dad825e869e4d915c46d71bb72b4f318f9c52d9a1381d391bad73aef5e555057e8189dca479359fa635b19727bb64d1876c1403057ed1e1faca7
  • SSDEEP 3072:aoT9szr954q4qf8NWPr0Dp/XpoO1zDsJOFQVrFsUBTa488+6WniGxfLwxhqSEaqw:0r95wCPADpaOOwajTa65HyigEX1OeLn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10
• • Target
    2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe
  • Size 2.4MB
  • SHA256 2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421
  • MD5 42935359d9ae5ab7507f082c117c0027
  • SHA1 05dd7616805833497c0ec1826ffc53b7673d8191
  • SHA512 f7fb318258fd7faaed95facea3b8c1ee2c11c13cb5ea239773b22ae5e270cef94a1892dfd2f60df15cf79f9f4935e4145bf5127734ff8893c3020c245d18189a
  • SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCH:eEtl9mRda12sX7hKB8NIyXbacAfk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  persistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral11
• • Target
    37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
  • Size 953KB
  • SHA256 37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60
  • MD5 5fc3bd9632a02f189d81f75fc3b12ebf
  • SHA1 6abbc78a6fb421adf80051365dbfaff0b3fb696b
  • SHA512 cf0b9df6db5c85ebc85967dbfbdd99ada401f718445f69f258d9d0a9466f7b58a7bb2f1287cb5679988bd79b42807fa0e0e7fc419557f0af3fbb620b40b2c2af
  • SSDEEP 12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Renames multiple (193) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral12
• • Target
    38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe
  • Size 1.9MB
  • SHA256 38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c
  • MD5 d28e88e6e9ad654f81909e605f3398c1
  • SHA1 84726882c606eec6b7ed7d0ba1d9acdd13390e45
  • SHA512 3e971529338ef0576ce40679b33fb763b2e1f3e7c16255b922434baf486d6569ee1e0770959ba7763b9759d89bf55b149d54546bdfa7299c41fd2c5d302ecaf7
  • SSDEEP 24576:tnxLSUXY7WSIGgjvvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZDv1xim+y6HLOO3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  discoveryexploitpersistenceransomwarespywarestealer

  • Renames multiple (8478) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Possible privilege escalation attempt

    exploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral13
• • Target
    3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe
  • Size 6.3MB
  • SHA256 3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096
  • MD5 6a7b2c486baa38a1d89e10889fc0802b
  • SHA1 6b8ddf08972160a12e144e00aa8a486b3c35e5e1
  • SHA512 a1d60b7113fea5c71309cb2bf49758802f73c5c8152030b7376d8ae2eb7c87d117fdb72b29f73e11c9cbc3ed17ef68a856ce56ed3d93fe4143f9085fd191f739
  • SSDEEP 98304:RfrQZerQZ2cK5YOXwnS4rV340Jy9+lG498HL:Rfr2er22KIJZr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral14
• • Target
    49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe
  • Size 2.8MB
  • SHA256 49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b
  • MD5 4431e8c03162a470cc1c74edfded4afb
  • SHA1 1fdd90a0a702447aebbd683e175c85a50acb9715
  • SHA512 f006cab8488dc669b5d23e64eea14efce8f6c90cd1ab57b71967e9ecb1748f57da2d5d6bf7eb824338b6025346abd823391abb2932e9d2eb719d55404f565922
  • SSDEEP 24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEC+:BSy6PX3PpM+P5IdF+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral15
• • Target
    4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
  • Size 390KB
  • SHA256 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
  • MD5 8c64181ff0dc12c87e443aae94bf6650
  • SHA1 e91d7ebd17912785caa3e71ef1571dc01b1cd854
  • SHA512 4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
  • SSDEEP 12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mimikatzbootkitpersistencespywarestealer

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral16
• • Target
    4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe
  • Size 2.6MB
  • SHA256 4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a
  • MD5 ca1e56a26f9b7b8e18a5f627bd946d53
  • SHA1 80f9a9afa9a115acabd32ddbd0339a17d261e90c
  • SHA512 d48549c184754f7d7e3c5b35c14aab50766aaa00eb8ce62d326a44ce9ccfc0b40bc94e33fa00c8b7594dfc0585f0c6530597d1222d8cb03edcb701de203af679
  • SSDEEP 12288:jOU/d7WQvyPWa4DQFu/U3buRKlemZ9DnGAevjdMOU/d7WQvyPWa4DQFu/U3buRKO:7/JRyuN5e/JRyuN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral17
• • Target
    4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe
  • Size 2.8MB
  • SHA256 4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168
  • MD5 aa5c75d313a98f3284d7ef52236d2d46
  • SHA1 085b7906df9bb7c07b254e9f1dd3c1015b581d8b
  • SHA512 0302c54bc87cc38f28e7d3b428fc51256f828831501e341e720e9b477d24241071e402675fc6e73d12daf4917f25a874a4a4b614f15b12d8d7be210e15ea19ac
  • SSDEEP 24576:WS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEgl:WSy6PX3PpM+P5Idtl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral18
• • Target
    5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe
  • Size 25KB
  • SHA256 5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7
  • MD5 d2623fa5d0ce3b4746b1803caed0fdf6
  • SHA1 339883e34e0cbc23f4c7a6ddb2376b420066fa1f
  • SHA512 3140427772552c53ceafa9f745f6349f170401d6b3ae72d641d3004b5b4cfca82b04c30e6734f1b1fec97dcdbc452a36d2ffca4a014eb5851ea2c0f6bf4969f7
  • SSDEEP 384:a3MLWHn3kI3fcSxlR2WpOYsBNakQJgr91Czxb5fe6uaVyZK:+n3kIE69pCYgr9ixbZe6PVyk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral19
• • Target
    67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
  • Size 2.0MB
  • SHA256 67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478
  • MD5 eba1ad16bc2fa284adae07cbebef8f7f
  • SHA1 225163dfd08838ae6bfec6e27994b92955013576
  • SHA512 909a8663ee28f43e7737f36707ee1a0195cd73e441dc4d2e6497d6bd7dad67465e21cdb0dd0e07511313673c1f8847c7a85966876165d197566dbbae8f34459b
  • SSDEEP 49152:iFOLMMFExN0CZb979qfWqcWMT2I9tH2gpNcjsUnlww3GJIV4p:gOIMqvTF9qf5cWMT99tH2s4sUnKoo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral20
• • Target
    6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe
  • Size 145KB
  • SHA256 6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e
  • MD5 9f16d35de8c312ba0b6f9efd558487fe
  • SHA1 93040ad968110a6c96c9e2f74f6902aa52b71057
  • SHA512 1534d12e38937d0c9597f67540b1c849728a637eb7dcd1286e28c9bd72a463bdbc492247beffd16e47986157323134edc84eb1d1f2e857d5c4a136427fe99699
  • SSDEEP 1536:6Cpb2XbbPD1c2lB4a9wL7vkYq0Hk5rR5JkVJ4y/uU/rLV9YYccquTrX7YeOzk+7J:ZyXbt4aEcTrR5OVZ/rLV9Yrcqu3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  persistenceransomware

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral21
• • Target
    6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe
  • Size 6.0MB
  • SHA256 6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe
  • MD5 7f97b34a113170d02ff8008c2bbc7745
  • SHA1 fe00b8cfc0896d6d23ff3628af8c406a7683d707
  • SHA512 a899eb8481c02d0c983c7761ca9962ffdea22354cdef6cefeadbdf0ac96d43a54c02ea72e89b8b5c2bdefed38ecdd960a8d267e3fc15545286844baf40ac9e93
  • SSDEEP 49152:LwLwHt4Ihqew+96PoBjYs5ngToDEZwTFgN+1TtI1VjFF3PBTqJQkYUjeAb3WUpPb:L9fhqezRobVjFyEUqA6Sp+ZIogCxfwis
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gandcrabbackdoorpersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral22
• • Target
    75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe
  • Size 2.7MB
  • SHA256 75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734
  • MD5 024f23eff975f6989dd2dc4340886961
  • SHA1 d553862c0cb3ab3ad5cba7654c038c966ebc9a00
  • SHA512 4c62ebc36cca4ef4ff9d59e8497047436a7f9f51d78d9dc6d29a657052b997479378d46fc5616150bc62cb7211e623c2012fdd7cca2b4e96f54e64d61975e98a
  • SSDEEP 24576:s1S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:s1Sy6PX3PpM+P5Id
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral23
• • Target
    82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe
  • Size 270KB
  • SHA256 82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a
  • MD5 14ea366be5cb691078be2c302590f435
  • SHA1 84e562bb99249a58849f6f82b29a7746dd144900
  • SHA512 9be5097295010fa04e04fcae578b19ab43935b09a70d8b31a038fd1ef7ed89dcd9143b82400e8d31913bf32a7a18628557dfaa1f4d37c1e7c8062d7a7368afb9
  • SSDEEP 6144:r02q9t3hysg2+00aHYHjdCoD5oa+S/dIm:Aj3hBg/00aHYDd3DCO/dI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral24
• • Target
    8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe
  • Size 604KB
  • SHA256 8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347
  • MD5 697deef7b2ca6b79c3608ebdf9c70977
  • SHA1 64fb76029f4d7b3aa06646f286182daf4de2a27a
  • SHA512 18870c02d0193349748447d92eb1fd2540ad02d54b736e9ce42dbe275acee5cbaa09d4f95e188a94d29e69f9349ff0bbe60e937880a867d4573847d93f7b2f8e
  • SSDEEP 12288:/g1YsKMSiS9SW35dmhqoeBsGJGKlOD4BZXu3lKG3pHLb4:/gd5QSW3rQqoeBsGJGTyG3JLk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ransomware

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral25
• • Target
    8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe
  • Size 2.8MB
  • SHA256 8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd
  • MD5 7db89ef8195831eb737b0a13cfbd8c60
  • SHA1 3c8d54c374bda8cc955cfc7477f9e385f24e9592
  • SHA512 537ce51e4351fdd8fed8a1cc3e497097847bd84c1d7e058d6e5672c1cc419cbdfb98c5af822af167fff2761127a33070fc65f2f724116cca206b56b3e8df267f
  • SSDEEP 24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEzQ:BSy6PX3PpM+P5IdYQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosneshtadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral26
• • Target
    8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe
  • Size 3.3MB
  • SHA256 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c
  • MD5 acd46f88a6f90143090c342c10544ccf
  • SHA1 bb90bed3b0d747feeac32536d75c6d153b34be0b
  • SHA512 82e91a14b2a7bfb659a566df7caf7f8dc28b61a14c504dd6ca23166ff2bb142114a43c5a3c70309022d813f34fb3aa63d321d964f3b6178e42b650ac0e56e84f
  • SSDEEP 24576:v54IAnWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKI:CIAWjdAp1PagjLuSh3i+FtvkMzT+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mafiaware666ransomware

  • Detect MafiaWare666 ransomware

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Renames multiple (3507) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops desktop.ini file(s)

  behavioral27
• • Target
    8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe
  • Size 128KB
  • SHA256 8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720
  • MD5 85db480564216a2842299723f2537f57
  • SHA1 97f5a29bb43312689de4c043dbea6a424319f407
  • SHA512 c413c3c7dd57abacf2ea431127ddbb89884604dcbcf0a34f74de6b78dc30036602b0c36300eda1169470583a02bd34abf0371a12a6791c300fef0154fe6708c0
  • SSDEEP 768:8Jqo2zIpszlgqr91OC/ehhegFH4MkaL5PEs:8co21lgqr91OzhvH4QL5cs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (222) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral28
• • Target
    8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe
  • Size 131KB
  • SHA256 8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c
  • MD5 807b3c16e4b836511f326750bd175189
  • SHA1 b24792703c3f05e07a668b4c1b701799b7e6fb6b
  • SHA512 844c26ecc56929ca444344d22265e6e02debe1713c99a732c80cbee3474852b48aa359567a1e3e78cc165441177dd9f8880b8213806d69aac0e8df4352cf969b
  • SSDEEP 3072:KFk4WBCsljJ8lSATxHt2bFZQhdFC7UtrK:KFkNCstGwATxN2bkFC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasionexecutionpersistenceransomware

  • Disables service(s)

    evasionexecution

  • Renames multiple (72) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Modifies WinLogon

    persistence
  behavioral29
• • Target
    8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
  • Size 353KB
  • SHA256 8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7
  • MD5 74236c89b9fcb1194bcf19cf5920f3e3
  • SHA1 7954ff64d20eae792a36ca2cf10a17da35cfbf27
  • SHA512 fbf08ee1017ec6a497a468a5fcfb618bddab57b9bf087f1d478187410458e3922e9d48e9bb872098a0a912bcd3c096c11075ba8142df64cf3cdaaa833504ad83
  • SSDEEP 6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnq9Bx:WeUjNHCFkw3OCMpxcXiPoK9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Stops running service(s)

    evasionexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral30
• • Target
    9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe
  • Size 976KB
  • SHA256 9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275
  • MD5 52e77b6c313dccdf3e013b86a8cdd915
  • SHA1 72051bf592b4da79b44d704b675a810ad387a549
  • SHA512 7a9e397af4f1963e742c1125e55c9808b1e90b077c98be374638d06bccce2106e6c436e4629b6a5233f22adc451a9f351b99a8f45a2a86802a0d21c73860b4da
  • SSDEEP 12288:hUFOlD+3ryYy5zOuMEXyfrznawAmcCh7axyK9E3+ez2pSqxnBPrAM+zwbRU3i+yF:/a0rbpZ7mi+y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral31
• • Target
    9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe
  • Size 164KB
  • SHA256 9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920
  • MD5 44f3a9311b23d84f336cc5b856f16682
  • SHA1 45e9f3c9836926822d4164848dad0dc6d5fd22d5
  • SHA512 858d16972a6fece4dd3a30b77f7415433c994a4edaa0064282b5f2b2027d8d0d31e21ac66583e270d7c0cfc42d1bd56cdd506fdf86d67994c78275be58282f6b
  • SSDEEP 3072:k3kw4Rlr9i0uIYGSKrG8yaJYCZWKuzfo5dXuZRodZXJvPbtH:64Pr9i00GrtUwJj1hH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral32