chaos

General

Target

2024-08-15_bc020a8f9d02f4140357a1d73f2c2e86_destroyer_wannacry
Size

27KB
Sample

240815-g53cwathln
MD5

bc020a8f9d02f4140357a1d73f2c2e86
SHA1

b0e59c5cda9b5a336b1db42ef75f4f29853f5098
SHA256

809a51672e7a7731fef45bf159d61b4b43b7e59bedb16a7890cb5c348706a4cf
SHA512

c4ed26916ac89e84696f3738bcdf7a046b007f264cb3cad73d6fbf585db5d33ae5d2fb50837268e56ba38e61ffe4119c4beac55d4e46051edb8b20c7bd68b500
SSDEEP

384:X3tWZPzzxAm1vp5ZRoDt71+k/zxBSKrIPlnOy5o91I0Ip3682vh3Q:XO7zxAmpfytgk/26Iho92Q8253Q

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-08-15_bc020a8f9d02f4140357a1d73f2c2e86_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  bc020a8f9d02f4140357a1d73f2c2e86
- SHA1
  
  b0e59c5cda9b5a336b1db42ef75f4f29853f5098
- SHA256
  
  809a51672e7a7731fef45bf159d61b4b43b7e59bedb16a7890cb5c348706a4cf
- SHA512
  
  c4ed26916ac89e84696f3738bcdf7a046b007f264cb3cad73d6fbf585db5d33ae5d2fb50837268e56ba38e61ffe4119c4beac55d4e46051edb8b20c7bd68b500
- SSDEEP
  
  384:X3tWZPzzxAm1vp5ZRoDt71+k/zxBSKrIPlnOy5o91I0Ip3682vh3Q:XO7zxAmpfytgk/26Iho92Q8253Q
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2