chaos

General

Target

2024-10-28_98011861dd4642548822c5638e7c9ea6_destroyer_wannacry
Size

27KB
Sample

241028-jelnjsthnp
MD5

98011861dd4642548822c5638e7c9ea6
SHA1

9084b3fd1166451a8380a9d00294cc7dafbef923
SHA256

093a58d6f3473fe31b0a10238a202f1abb9586109bba2d3db1690ddfeec896e5
SHA512

6f54e4a69ab351469943e5ddac3259ab55b7351a2d75fc4857262eedd8c4f4b2d05e16ba30e6c0e84d8d91d731b4ad19711a91a9a3f4bccb86d1b2bd7bc4db20
SSDEEP

384:UtWZPzzxAm1vpe1HY6TWnfzvOpaRIlPOy5o91WE5NdVS82vn:57zxAmO1HQzvgaEho94E5Nd882f

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-10-28_98011861dd4642548822c5638e7c9ea6_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  98011861dd4642548822c5638e7c9ea6
- SHA1
  
  9084b3fd1166451a8380a9d00294cc7dafbef923
- SHA256
  
  093a58d6f3473fe31b0a10238a202f1abb9586109bba2d3db1690ddfeec896e5
- SHA512
  
  6f54e4a69ab351469943e5ddac3259ab55b7351a2d75fc4857262eedd8c4f4b2d05e16ba30e6c0e84d8d91d731b4ad19711a91a9a3f4bccb86d1b2bd7bc4db20
- SSDEEP
  
  384:UtWZPzzxAm1vpe1HY6TWnfzvOpaRIlPOy5o91WE5NdVS82vn:57zxAmO1HQzvgaEho94E5Nd882f
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2