chaos

General

Target

2024-10-28_447e7a2f21a3c0a1f0be38dd189d9b44_destroyer_wannacry
Size

27KB
Sample

241028-3gd62azcpa
MD5

447e7a2f21a3c0a1f0be38dd189d9b44
SHA1

0e48b7f5a701e15bef22cf073e6659c9f1eb38dd
SHA256

cbbf7dfd8675318f248ada8eda44d7cb9f0ccf1d221340d743a394ffa9ea83bd
SHA512

b463d858b567cb472e484fbbacefe76c7ce9211c2434fce5e05b19152f41b960307396fd0e95f6bca485a6ea0d90a9ed838ed3f86df1c37f0f194bc4a97e1da6
SSDEEP

384:CtWZPzzxAm1vZTyHFjhFKW6pjwhnAQ5cHlkOy5o91GXzRpz82vp:H7zxAmiJhz6pjxQ5Dho9UXz3z82B

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-10-28_447e7a2f21a3c0a1f0be38dd189d9b44_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  447e7a2f21a3c0a1f0be38dd189d9b44
- SHA1
  
  0e48b7f5a701e15bef22cf073e6659c9f1eb38dd
- SHA256
  
  cbbf7dfd8675318f248ada8eda44d7cb9f0ccf1d221340d743a394ffa9ea83bd
- SHA512
  
  b463d858b567cb472e484fbbacefe76c7ce9211c2434fce5e05b19152f41b960307396fd0e95f6bca485a6ea0d90a9ed838ed3f86df1c37f0f194bc4a97e1da6
- SSDEEP
  
  384:CtWZPzzxAm1vZTyHFjhFKW6pjwhnAQ5cHlkOy5o91GXzRpz82vp:H7zxAmiJhz6pjxQ5Dho9UXz3z82B
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (194) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2