chaos

General

Target

WinRAR.7z
Size

100KB
Sample

240829-mfgmrswfph
MD5

be127ef325cfb4fc0bdebc4a5ff449c2
SHA1

57d83936a5bdf97f667bdfae800aa5e0dfd8961f
SHA256

fa4a448efd262bc6b21ced8340789c3ad24de0f4956d371d346780cf91675996
SHA512

fe770663d10bbdce73dc17f806cc5f41e176201ef29cedc2434777071e09d3ca3cae58c76eb3ed582e369f4e5d4ce2807e4424f1b5eac99076c03e0a6e9a3b0f
SSDEEP

3072:aY9wNefuN0dRzX7gnxadGjNmR51n1S6YsOplVp:aY9wQm0rgAdGjQt1ShdpV

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\NOTE!.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  WinRAR.exe
- Size
  
  270KB
- MD5
  
  14ea366be5cb691078be2c302590f435
- SHA1
  
  84e562bb99249a58849f6f82b29a7746dd144900
- SHA256
  
  82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a
- SHA512
  
  9be5097295010fa04e04fcae578b19ab43935b09a70d8b31a038fd1ef7ed89dcd9143b82400e8d31913bf32a7a18628557dfaa1f4d37c1e7c8062d7a7368afb9
- SSDEEP
  
  6144:r02q9t3hysg2+00aHYHjdCoD5oa+S/dIm:Aj3hBg/00aHYDd3DCO/dI
Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1