chaos

General

Target

c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe
Size

17.5MB
Sample

240904-sb5fxstfka
MD5

745dace4330180dc2ece98bbdbaee620
SHA1

1658df5af15596ab7f10815f0c9b07882198e319
SHA256

c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6
SHA512

918154f58072db9a02244b9cdc3674e93b471ecb5f3d7d78591bb6da9954fe57d933bc3a1241d4f789bf450f4d3dda8a4abbecf36dda3913bce2c36766c766c4
SSDEEP

393216:WQ1HRaZfyXgI1RxnJnkeJPHxstm7NjJP5BkWTZ:WQxoZqXgQnfsopjp5BkWl

Score

10^/10

Malware Config

Targets

- Target
  
  c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe
- Size
  
  17.5MB
- MD5
  
  745dace4330180dc2ece98bbdbaee620
- SHA1
  
  1658df5af15596ab7f10815f0c9b07882198e319
- SHA256
  
  c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6
- SHA512
  
  918154f58072db9a02244b9cdc3674e93b471ecb5f3d7d78591bb6da9954fe57d933bc3a1241d4f789bf450f4d3dda8a4abbecf36dda3913bce2c36766c766c4
- SSDEEP
  
  393216:WQ1HRaZfyXgI1RxnJnkeJPHxstm7NjJP5BkWTZ:WQxoZqXgQnfsopjp5BkWl
Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence pyinstaller ransomware spyware stealer credential_access
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (191) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2