chaos

General

Target

3e765f2c48e0649253617b42a1528640N.exe
Size

27KB
Sample

240722-cj23rsxepr
MD5

3e765f2c48e0649253617b42a1528640
SHA1

3dbd1c5b6b83de62780e9f12003050c258ec7707
SHA256

11ee97eec9363baab3e38c95298b781e1bb330bb8fe80a4e1a08a10c4e9fbb74
SHA512

e3e84bf048595f4ca53079f97bb5b38dfc84a1f2f57890758ce9ab315333d9b90825d36516cbb8bb7d8e24aac8f398cadd35bda2eefd7f0913cb13fafe2ccf32
SSDEEP

384:xtWZPzzxAm1vp5ZRoDNhvLKeOS2NiTclTOy5o91bT3+pJ82vu:47zxAmpfyzeeOSSiaho953+P82W

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  3e765f2c48e0649253617b42a1528640N.exe
- Size
  
  27KB
- MD5
  
  3e765f2c48e0649253617b42a1528640
- SHA1
  
  3dbd1c5b6b83de62780e9f12003050c258ec7707
- SHA256
  
  11ee97eec9363baab3e38c95298b781e1bb330bb8fe80a4e1a08a10c4e9fbb74
- SHA512
  
  e3e84bf048595f4ca53079f97bb5b38dfc84a1f2f57890758ce9ab315333d9b90825d36516cbb8bb7d8e24aac8f398cadd35bda2eefd7f0913cb13fafe2ccf32
- SSDEEP
  
  384:xtWZPzzxAm1vp5ZRoDNhvLKeOS2NiTclTOy5o91bT3+pJ82vu:47zxAmpfyzeeOSSiaho953+P82W
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2