chaos

General

Target

chaos_main_f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
Size

1.3MB
Sample

240731-1xgkzszgrh
MD5

840eb9e50c131322605c5ea90ae1312f
SHA1

fc9548f91123e05196dad6bcab11d29abd01500c
SHA256

f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
SHA512

8e37c5890089bf1997e1c4c777a92f71eae9a86f11d1fb3cb3671dfa8c15c4365ed1f8811e6aae4d31f0fe73c1960b142f684a5274f086491f7d238a79313ffe
SSDEEP

12288:75gafkW6xqP9iz8ZW29ohk3qHS/6gOHeA/MBU/7x5qDyNjC9Ha1DKs5y6blZRjHe:7Db/s/MSldTzfY/YRSv225PUXW8iF

Score

10^/10

Malware Config

Targets

- Target
  
  chaos_main_f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
- Size
  
  1.3MB
- MD5
  
  840eb9e50c131322605c5ea90ae1312f
- SHA1
  
  fc9548f91123e05196dad6bcab11d29abd01500c
- SHA256
  
  f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
- SHA512
  
  8e37c5890089bf1997e1c4c777a92f71eae9a86f11d1fb3cb3671dfa8c15c4365ed1f8811e6aae4d31f0fe73c1960b142f684a5274f086491f7d238a79313ffe
- SSDEEP
  
  12288:75gafkW6xqP9iz8ZW29ohk3qHS/6gOHeA/MBU/7x5qDyNjC9Ha1DKs5y6blZRjHe:7Db/s/MSldTzfY/YRSv225PUXW8iF
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (180) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2