chaos

General

Target

2024-08-22_e7bd89cb405b3a1e0b34bea003b27ec5_wannacry
Size

217KB
Sample

240822-mw991ssglb
MD5

e7bd89cb405b3a1e0b34bea003b27ec5
SHA1

21061b3432c8e6a56f6b4e7b755d73f072f47f94
SHA256

2a58499667712ca4e34cdf24cb2fa54828e76a254e780c3ac0fbb570f6148bf5
SHA512

d0e592d846f0bc9a47f67036826079fe2ad4d777b52d5cd54bbfd0bf2f2834b54ea75e59ec34b2867aea51377cbd54f1186655d655f09c66ba2ec09407628231
SSDEEP

3072:6ob0Exr9jos+uorMvZprdSyI+gPTfqyYgytVx9T8AOtZCWcW7ubxvOGIx3sBsNkw:P7r9jJ5orwrRS8gPFYTdOjbGXypU5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\wowie.txt

Ransom Note

Your files have been encrypted! All your important files have been encrypted. To regain access, you need to purchase a decryption key. Instructions: 1. Purchase $50 worth of Bitcoin at https://blockchain.com. 2. Email us at [email protected] 3. After we send you the wallet address and you give us the bitcoin, we will give you your decryption key. Important: You have 24 hours to do so. Failure to pay and decrypt your files, they are lost forever. Bonne chance!

Emails

[email protected]

URLs

https://blockchain.com

Targets

- Target
  
  2024-08-22_e7bd89cb405b3a1e0b34bea003b27ec5_wannacry
- Size
  
  217KB
- MD5
  
  e7bd89cb405b3a1e0b34bea003b27ec5
- SHA1
  
  21061b3432c8e6a56f6b4e7b755d73f072f47f94
- SHA256
  
  2a58499667712ca4e34cdf24cb2fa54828e76a254e780c3ac0fbb570f6148bf5
- SHA512
  
  d0e592d846f0bc9a47f67036826079fe2ad4d777b52d5cd54bbfd0bf2f2834b54ea75e59ec34b2867aea51377cbd54f1186655d655f09c66ba2ec09407628231
- SSDEEP
  
  3072:6ob0Exr9jos+uorMvZprdSyI+gPTfqyYgytVx9T8AOtZCWcW7ubxvOGIx3sBsNkw:P7r9jJ5orwrRS8gPFYTdOjbGXypU5
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2