chaos

General

Target

2024-11-22_e31f3d42bf3d0fc4d8f2a568eb956d01_destroyer_wannacry
Size

27KB
Sample

241122-3fs9kaxrhm
MD5

e31f3d42bf3d0fc4d8f2a568eb956d01
SHA1

34fcda5e1628d6872c7d61a42d45ec11d9efcd31
SHA256

3fdabc2dd0da231d971197eae267c8c34ac1bf4e89a9417742408db184a90d32
SHA512

64229dcdc7cca556ab2efb852ab7dd51b5f3d7c446dbcd42e0a8f6076bde5d6d993fb2b680c5c9a7c2f8d606df0c3c71facc32fc3b62b8c05b7076807366460f
SSDEEP

384:4tWZPzzxAm1vp5ZRoDPpYOcYgDzY7gFWlKOy5o91QFpK82vf:N7zxAmpfyP0YQYk7ho9+FQ82H

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-11-22_e31f3d42bf3d0fc4d8f2a568eb956d01_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  e31f3d42bf3d0fc4d8f2a568eb956d01
- SHA1
  
  34fcda5e1628d6872c7d61a42d45ec11d9efcd31
- SHA256
  
  3fdabc2dd0da231d971197eae267c8c34ac1bf4e89a9417742408db184a90d32
- SHA512
  
  64229dcdc7cca556ab2efb852ab7dd51b5f3d7c446dbcd42e0a8f6076bde5d6d993fb2b680c5c9a7c2f8d606df0c3c71facc32fc3b62b8c05b7076807366460f
- SSDEEP
  
  384:4tWZPzzxAm1vp5ZRoDPpYOcYgDzY7gFWlKOy5o91QFpK82vf:N7zxAmpfyP0YQYk7ho9+FQ82H
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2