chaos

General

Target

2024-09-28_ffbc15b6c374874f214ed0982fc4ae26_destroyer_wannacry
Size

27KB
Sample

240928-kpavgawhpr
MD5

ffbc15b6c374874f214ed0982fc4ae26
SHA1

5b8b49e7ef5114c92a76d4b382370c99216f3274
SHA256

50506fe1e131e46ee0a6ab1bfb5b7bb9173ddbcbe8c0274f1c5f37b6ab42dfe5
SHA512

3acbca98c50433a1f2015cedb56c3d4e8cdf3f4dc3d8e426c609f4b38b76d2985e1090991bfb3896d942e2cbd1b8d41a7636a2fe64e8484bcb9568d051e5728e
SSDEEP

384:R3tWZPzzxAm1vp5ZRoDoWfa2D6dzCksJlYOy5o91cZp782vL:RO7zxAmpfy22D7kTho9iZF82j

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-09-28_ffbc15b6c374874f214ed0982fc4ae26_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  ffbc15b6c374874f214ed0982fc4ae26
- SHA1
  
  5b8b49e7ef5114c92a76d4b382370c99216f3274
- SHA256
  
  50506fe1e131e46ee0a6ab1bfb5b7bb9173ddbcbe8c0274f1c5f37b6ab42dfe5
- SHA512
  
  3acbca98c50433a1f2015cedb56c3d4e8cdf3f4dc3d8e426c609f4b38b76d2985e1090991bfb3896d942e2cbd1b8d41a7636a2fe64e8484bcb9568d051e5728e
- SSDEEP
  
  384:R3tWZPzzxAm1vp5ZRoDoWfa2D6dzCksJlYOy5o91cZp782vL:RO7zxAmpfy22D7kTho9iZF82j
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2