chaos

General

Target

63fde64543a837c1cf7072bb0478445232d526597a252e335381081f75745bee
Size

23KB
Sample

240811-1q99qavama
MD5

003890676b63239d5fef463e4dd46ed4
SHA1

5a9e67ac8794d9bcf18c1e67da5c0bdf1c0adfba
SHA256

63fde64543a837c1cf7072bb0478445232d526597a252e335381081f75745bee
SHA512

e77d77e8619e700c106b658be724406167043a2989e8da250983dbb4a68481fc76c7b3d5fd433d68cdd1012840e0d6b7ace501facf73d782e392c447b6cc3f6d
SSDEEP

384:33Mg/bqo2mJk5BFnqXipFqjuwzU3Jmr91CdFHbTKe3:hqo2b5iXip0jK5mr9YFHbGe3

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qma7ln7jfq5c7kl6du2cth8g7z8u468n4txw5rx

Targets

- Target
  
  63fde64543a837c1cf7072bb0478445232d526597a252e335381081f75745bee
- Size
  
  23KB
- MD5
  
  003890676b63239d5fef463e4dd46ed4
- SHA1
  
  5a9e67ac8794d9bcf18c1e67da5c0bdf1c0adfba
- SHA256
  
  63fde64543a837c1cf7072bb0478445232d526597a252e335381081f75745bee
- SHA512
  
  e77d77e8619e700c106b658be724406167043a2989e8da250983dbb4a68481fc76c7b3d5fd433d68cdd1012840e0d6b7ace501facf73d782e392c447b6cc3f6d
- SSDEEP
  
  384:33Mg/bqo2mJk5BFnqXipFqjuwzU3Jmr91CdFHbTKe3:hqo2b5iXip0jK5mr9YFHbGe3
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2