chaos

General

Target
7737fb5fa7440206dbbd7dbeb8222a2851caf6210005e37d6d5d765081940e9a.exe
Size 17.5MB
Sample240905-bx3e1s1gpg
SHA256 7737fb5fa7440206dbbd7dbeb8222a2851caf6210005e37d6d5d765081940e9a
MD5 fe194bd31f2388a09bbef24ddaa212ce
SHA1 cb01c1cb0a2fc192c28b3d7864e739d9d8575e08
SHA512 c682844cbe5899465e6ba14304a7d6cdfabb41c2f31c94e0407af953cf9889ed70da6a27615d868e2e9fa7f3711db488741c3cd68789a5ed7ac4fb1a60478054
SSDEEP 393216:2VVC+w99uPfkiyV4wqWisNWhQkUS9O6OKpsSH+sWTF:2m/fiyyFWFN7kJOKpsk+sWJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  7737fb5fa7440206dbbd7dbeb8222a2851caf6210005e37d6d5d765081940e9a.exe
- Size 17.5MB
- SHA256 7737fb5fa7440206dbbd7dbeb8222a2851caf6210005e37d6d5d765081940e9a
- MD5 fe194bd31f2388a09bbef24ddaa212ce
- SHA1 cb01c1cb0a2fc192c28b3d7864e739d9d8575e08
- SHA512 c682844cbe5899465e6ba14304a7d6cdfabb41c2f31c94e0407af953cf9889ed70da6a27615d868e2e9fa7f3711db488741c3cd68789a5ed7ac4fb1a60478054
- SSDEEP 393216:2VVC+w99uPfkiyV4wqWisNWhQkUS9O6OKpsSH+sWTF:2m/fiyyFWFN7kJOKpsk+sWJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence pyinstaller ransomware spyware stealer credential_access
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (222) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2