chaos

General

Target

randsomware.exe
Size

23KB
Sample

240806-q2d1js1apk
MD5

d5440a95def9346312619fd007f4926d
SHA1

5565b91e8c947e78187d3aa4988699efe176aa92
SHA256

c0670eb1d76dd75a08a3528919a93bbb8398b55ba34dc749673cc1ce7cd33436
SHA512

2107241f6ae50ce5e74a7c9042e51af53ca53c88066dd753716bd81ab0f91936bbf2e45b3d713c3899f434075062ee0cac071b05069a815109aa49dad983d277
SSDEEP

384:r3MLWHn3kI3ShqoIQpClC3NRUJ2r91CrLb5ZeB:3n3kIdLQppdR82r9SLbjeB

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Targets

- Target
  
  randsomware.exe
- Size
  
  23KB
- MD5
  
  d5440a95def9346312619fd007f4926d
- SHA1
  
  5565b91e8c947e78187d3aa4988699efe176aa92
- SHA256
  
  c0670eb1d76dd75a08a3528919a93bbb8398b55ba34dc749673cc1ce7cd33436
- SHA512
  
  2107241f6ae50ce5e74a7c9042e51af53ca53c88066dd753716bd81ab0f91936bbf2e45b3d713c3899f434075062ee0cac071b05069a815109aa49dad983d277
- SSDEEP
  
  384:r3MLWHn3kI3ShqoIQpClC3NRUJ2r91CrLb5ZeB:3n3kIdLQppdR82r9SLbjeB
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1