chaos

General

Target

376a0dcffbce35c7314ce476ffc708652aed293b82053552f1ac221ab26bd1c6
Size

214KB
Sample

240805-cwbfksybjh
MD5

decac40b23959b95743cb806c8d05f63
SHA1

d8ccabfce2ab3d88464df76e12dcc4926dff7b77
SHA256

376a0dcffbce35c7314ce476ffc708652aed293b82053552f1ac221ab26bd1c6
SHA512

4ab055880f8a54824c0f5caf5a33ac036744cd2a5bddf638778a093192b1d2b6f6600125a878488c0cd7aa07a23372c656d1bf9f5679ce30de870fa8507bd88e
SSDEEP

6144:duxWeXKGu4nP1WtMV+2xJ6uMjW8RAK9Vu3sBENg:dHe6HmP13hvMHJkg

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\welp.txt

Ransom Note

Hello there! All your files are encrypted, but do not worry, if you're not poor that is. If you send us 50$ worth of Bitcoin, you will get a key that will decrypt all your files! Yipeeeee! Contact us at [email protected] After you send the $50 worth of BTC to the wallet, you will receive the key. Don't try to use any third party software to decrypt your files if you don't want to lose all your data.

Emails

[email protected]

Targets

- Target
  
  a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
- Size
  
  417KB
- MD5
  
  3dc9bad7720a01598aa14e55baca7413
- SHA1
  
  99668a82a34ec17340fccecbc2ef0985b84704a0
- SHA256
  
  a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0
- SHA512
  
  567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba
- SSDEEP
  
  6144:Jr9Zzp4MmFrxodIFRfiM6baHcgrRS8gPFYTdOjbGXypU5:Jp4MmxxhfiMzcyRQFYTdqTa
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2