chaos

General

Target

2024-10-05_865476860ffd6a3223280d9e95212a75_destroyer_wannacry
Size

27KB
Sample

241005-pq548axfrf
MD5

865476860ffd6a3223280d9e95212a75
SHA1

d709887cdec7260d241c364c8a3d05b899f99911
SHA256

275b74689249cc22ab5e5b502bb9456c76f0d81eb2c6c75914c3d89e398a4644
SHA512

c56cf225c3b416db0e01df3f41d8e03e88b267f4e5305118b76fd33dac8b78c600161393270af4f2d2ead9d03d0ecb56d7e6033f0139fa9ea1073e072dc9783d
SSDEEP

384:UtWZPzzxAm1vp5ZRoDsSgrPiEDNv8V8lQ/xw6fLlJqsvlIOy5o91hWfpC82vb:57zxAmpfysSLEZkqDho9efU82T

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-10-05_865476860ffd6a3223280d9e95212a75_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  865476860ffd6a3223280d9e95212a75
- SHA1
  
  d709887cdec7260d241c364c8a3d05b899f99911
- SHA256
  
  275b74689249cc22ab5e5b502bb9456c76f0d81eb2c6c75914c3d89e398a4644
- SHA512
  
  c56cf225c3b416db0e01df3f41d8e03e88b267f4e5305118b76fd33dac8b78c600161393270af4f2d2ead9d03d0ecb56d7e6033f0139fa9ea1073e072dc9783d
- SSDEEP
  
  384:UtWZPzzxAm1vp5ZRoDsSgrPiEDNv8V8lQ/xw6fLlJqsvlIOy5o91hWfpC82vb:57zxAmpfysSLEZkqDho9efU82T
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2