chaos

General

Target

20240825805d5b6a04bc59a03b0a5b957f29c43ddestroyerwannacry
Size

27KB
Sample

240825-qrh7hsybmk
MD5

805d5b6a04bc59a03b0a5b957f29c43d
SHA1

7eb6b748decf4e07c0a346af92ac25bc00e536a6
SHA256

5eef7f1b2ab55c74bcb21c2049e426b1fd6eb72c5e6bbe9b02bc59671f08938f
SHA512

94840fad346fda35b0b2c250f8e3966978a29f3cef4e29c575744c6f3cd6f9afd0d50a168e6496ac85950489d5bc0751f455b37eff8fd8721847df8f7856b37b
SSDEEP

384:utWZPzzxAm1vp5ZRoDNhvLKeOS2NiCXlKOy5o91A0GpL82v5:z7zxAmpfyzeeOSSiNho9+R82R

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  20240825805d5b6a04bc59a03b0a5b957f29c43ddestroyerwannacry
- Size
  
  27KB
- MD5
  
  805d5b6a04bc59a03b0a5b957f29c43d
- SHA1
  
  7eb6b748decf4e07c0a346af92ac25bc00e536a6
- SHA256
  
  5eef7f1b2ab55c74bcb21c2049e426b1fd6eb72c5e6bbe9b02bc59671f08938f
- SHA512
  
  94840fad346fda35b0b2c250f8e3966978a29f3cef4e29c575744c6f3cd6f9afd0d50a168e6496ac85950489d5bc0751f455b37eff8fd8721847df8f7856b37b
- SSDEEP
  
  384:utWZPzzxAm1vp5ZRoDNhvLKeOS2NiCXlKOy5o91A0GpL82v5:z7zxAmpfyzeeOSSiNho9+R82R
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2