chaos

General

Target

_)01( noci.scr
Size

262KB
Sample

240719-mmfztawfrr
MD5

e15358f77cb2d9a8f36300cd621cc68a
SHA1

168edfcabe08c67c7741d14a7f0cf926d846478b
SHA256

e8ca6295f91a857411273eea2fcf03989fc93f13f84c3cf2180bf556c89436d0
SHA512

debe87f0305ffcfae37d15edaa18287ec7ecd77a72bd585edf914bd9390db6dafe51c48beca6f1e6eef15f57967083516a250e1352c4746c704bab32d4fc86d1
SSDEEP

3072:HCk4Tq9ml9Zbgb1B+i1GlCdE4SrC1OMSn0vJAnR7Nn7ILJPopnWaGR8lJnHwCBF4:HJ4Tq9uPghIDN4unQ59P8WaomJBhnod

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  _)01( noci.scr
- Size
  
  262KB
- MD5
  
  e15358f77cb2d9a8f36300cd621cc68a
- SHA1
  
  168edfcabe08c67c7741d14a7f0cf926d846478b
- SHA256
  
  e8ca6295f91a857411273eea2fcf03989fc93f13f84c3cf2180bf556c89436d0
- SHA512
  
  debe87f0305ffcfae37d15edaa18287ec7ecd77a72bd585edf914bd9390db6dafe51c48beca6f1e6eef15f57967083516a250e1352c4746c704bab32d4fc86d1
- SSDEEP
  
  3072:HCk4Tq9ml9Zbgb1B+i1GlCdE4SrC1OMSn0vJAnR7Nn7ILJPopnWaGR8lJnHwCBF4:HJ4Tq9uPghIDN4unQ59P8WaomJBhnod
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2