chaos

General

Target

2024-07-29_4c059f843a1754b20e00f4c539a49a88_destroyer_wannacry
Size

27KB
Sample

240729-z7apra1crm
MD5

4c059f843a1754b20e00f4c539a49a88
SHA1

d3446478d643045c1b809644e6f02c6c9362ce60
SHA256

81102a99c4479b346464c884af1c3cfb10407bdcca5eba70dc0ace51c8d579e0
SHA512

d7a84ec8750fd9d5a54811529aa7e85a36837941ee8eaf93655001f174a0984f88e9829f76e64becc023c5a23bb4efedc5b77a2bc707fead758daf6ce5722a22
SSDEEP

384:iftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5lMlgOy5o91Gp382v+:iW7zxAmpfyCz6pVQ53ho9sx822

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-07-29_4c059f843a1754b20e00f4c539a49a88_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  4c059f843a1754b20e00f4c539a49a88
- SHA1
  
  d3446478d643045c1b809644e6f02c6c9362ce60
- SHA256
  
  81102a99c4479b346464c884af1c3cfb10407bdcca5eba70dc0ace51c8d579e0
- SHA512
  
  d7a84ec8750fd9d5a54811529aa7e85a36837941ee8eaf93655001f174a0984f88e9829f76e64becc023c5a23bb4efedc5b77a2bc707fead758daf6ce5722a22
- SSDEEP
  
  384:iftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5lMlgOy5o91Gp382v+:iW7zxAmpfyCz6pVQ53ho9sx822
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2