chaos

General

Target

AnyDesk.rar
Size

3.1MB
Sample

241005-ga5vhssend
MD5

5bbe147b4194cc8f375f6467f402cb32
SHA1

773a5ed27193d1ac3b3ff3344b2803a9af2f51a3
SHA256

474d33e3c9e05aed2bc5f15207134bc72fc4aed18bd89eadbd9712b57d4f9f59
SHA512

18e21b78ae3dd713b9e6e40e309ac0b58457b958782c6fbe2446106670472dea322aff294d9eaebe2ac0d662c0fb5107c1bc88edef9aa43fce325066a203e068
SSDEEP

98304:hTIhGnp88n0hAE4yhVu9VaoyysVhThwktmZN5UKqw:hTIonpn0hAEjEzaoFs6HN5Ew

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.0145 BTC Bitcoin Address: 1Fv8VepbEL9tVmBAzu5zvH8JcLDopUVfoS

Wallets

1Fv8VepbEL9tVmBAzu5zvH8JcLDopUVfoS

Targets

- Target
  
  AnyDesk.exe
- Size
  
  7.2MB
- MD5
  
  8f1eaaf77aa07ceb4af188ab50db4ed3
- SHA1
  
  15148c0a2044805762d8494600386f49aec07b55
- SHA256
  
  4c595e8e612d7663804656ecfb65d3a833e585652ba8f15f486611873420e9a1
- SHA512
  
  d8ffa382cb99d3d7a1659a66fe6d586fea42aec9c21243e3d9b03928faf139809a435cb51dd0ec8ca5902b60a3effe8847637751a4075297ca189b4515e1ffcc
- SSDEEP
  
  49152:MiZLYKiEYSkVodi19NPftSFwkrJxWxhlMOkj7EqTUOgA37MJ+WftYs:
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer discovery
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2