General
-
Target
ransomware.exe.zip
-
Size
161KB
-
Sample
241102-tz9k8aslhn
-
MD5
ce19d58a33ce4a02140d74b242a81127
-
SHA1
f2457afcec0c05989dbaee623e4fad5f4832b810
-
SHA256
47605791a693db665f7959dec141fbe5be94a4ce85e857952ffc4297954ac671
-
SHA512
79ad32b65df024b30e71efb3af11b1cf1c5669e22793514843cae2eebee3818cf063890f978088d9eceba3bc35717c39cf2a981db4f85bdbb864836b44d2dd6b
-
SSDEEP
3072:zXbWAyI65GfqeHwvV1nyh8RS3sPLfl66bIKRqCtOZVtPMyl5M8oeItQcizuDKWJ:XWE6gfqeQ91nS8MsD96KxHtO3xZgVmWJ
Behavioral task
behavioral1
Sample
ransomware.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ransomware.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
chaos
Targets
-
-
Target
ransomware.exe.bin
-
Size
381KB
-
MD5
761e82385ac656cdb40c5b9189ab0cf2
-
SHA1
f5e22aedb5435af95d2e76abd348661909526437
-
SHA256
b902f48739fa84be97815b796681a7b337c7bbcad14d436aeb6ba93b9fe5aebd
-
SHA512
373f3dbaffbd3cd1fed1f1e8cea542025936987830682ca642a88400c053fba0f913a3935cfab5e834c0c18dc459c21f4bee9636c7d790d66605384eb6d7e449
-
SSDEEP
6144:S4r9rWTixqewT/IDI32oQqDVJ2r1lXohOBkWTXd7umpqb:qmxIIM2ojJ2r1lYhOBkWTphpqb
Score10/10-
Chaos Ransomware
-
Chaos family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-