Overview

overview

10

Static

static

10

1ba5ab55b7...53.exe

windows11-21h2-x64

10

Resubmissions

23/07/2024, 13:55

240723-q8alpswflc10

06/09/2021, 06:44

210906-hhm54safa310

Sharing

Copy URL Twitter E-mail

General

  • Target
    1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
  • Size 610KB
  • Sample240723-q8alpswflc
  • SHA256 1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Documents\README.txt

Ransom Note
  • All your files have been encrypted !! Don't panic please ! We are here to help you. If you don't want to cooperate and hear your mind instead of our instructions, you will loose stupidly your files but even worse, we are able to kill your main windows process so you will never be able to restart your machine after. All your network may have been infected. If this is the case, note that the decryption software we will give you for one of the machine can be used on all the infected machines. That said, note also that if you don't pay, its all your machines that will get lost and kill. Fortunately, we think you are aware that we don't want this case to happens and you too. That's why to help you, we writed a list of instructions to follow if you want to restore your files. Once you completed all the instructions below, we will be able to give you the decryption software. We don't want to loose time or play with you, we guarantee that you will get that key if you complete your job. Don't be stupid !! To restore your files, you will need to pay a ransom within 62 hours or you will loose everything. The amount requested is 280 dollars. An amount you will need to pay in monero (XMR) which is a cryptocurrency like bitcoin (BTC). Our monero ID (adress where you need to send the money) is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 We encrypted your files with AES-256 encryption method. It's the strongest encryption method you can find in this world. Again, don't be stupid and pay the ransom. Its the only way to get all things to normal. Steps (instructions) to follow : Step 1 : Search localmonero in your browser search bar and click in the first result. Step 2 : Create an account. Step 3 : Search an offer (of a reliable vendor with lot of sales) that correspond to your payment method. Step 4 : Pay 280 dollars at once. Step 5 : Go into your account wallet and you'll see the amount of monero you have paid (it need to be 280 dollars). Step 6 : Send all the monero to our monero ID (adress) which is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 Please, copy-paste it carefully !! Verify if it correspond completly to the one in this text file before you send the money !! Once you send, it will take maximum 30 minutes to recieve. When, we will recieve the payment, we will send you the decryption software by email Please contact us at for help and negociation : [email protected] Thanks.

Targets

    • Target
      1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
    • Size 610KB
    • SHA256 1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (211) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks