chaos | ExilenceTG[.]exe | Triage

Sharing

General

Target

ExilenceTG.exe
Size

29KB
MD5

81ebd22d4165ecc269eb2b79119bb475
SHA1

417d38cb5a3255d23e653256eabb8eb6a9a1be9d
SHA256

66ee18b2f0f843af317e864b0787a6dacf891810bcf924cf3250f63efa005953
SHA512

bf6afca825e321beff2f17dd0aca7d3c2c0de5eb9a5099b32b27855c668b077ac0da811b2c0e71373e58d229aef736bfa52aa380e626abee27582628fbbfbd40
SSDEEP

384:RtWZPzzxAm1vd5VM6YE2r7OUmgIYfdQPFolUOy5o91qqclYhhg82v4:Y7zxAmhWF/rEgIYw/ho98Oc82Q

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

Processes:

resource	yara_rule
sample	family_chaos

Chaos family
chaos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
ExilenceTG.exe

Files

ExilenceTG.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mscoree

_CorExeMain

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ