chaos

General

Target

2024-11-28_346a4e45557cef682a089adf3602d8a5_destroyer_wannacry
Size

27KB
Sample

241128-2g8vzatjf1
MD5

346a4e45557cef682a089adf3602d8a5
SHA1

513ddb97634940a37f3ce420aca9d60088251215
SHA256

2f2319f1b99e0d0595b2e1e41e2e53fbbb92bb149d7e8c5cbb180324c7c9d59b
SHA512

df4a150dec0257321b52b21d7763f3dfdd04490b13925bd642ccac1207128e82255974eea7bb2c5930308e8383e97ddb8ee501f5816e6082bd8556cfa45c5f50
SSDEEP

384:IftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5z6l0Oy5o917aPjpg82vG:IW7zxAmpfyCz6pVQ5Pho9UPju82e

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-11-28_346a4e45557cef682a089adf3602d8a5_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  346a4e45557cef682a089adf3602d8a5
- SHA1
  
  513ddb97634940a37f3ce420aca9d60088251215
- SHA256
  
  2f2319f1b99e0d0595b2e1e41e2e53fbbb92bb149d7e8c5cbb180324c7c9d59b
- SHA512
  
  df4a150dec0257321b52b21d7763f3dfdd04490b13925bd642ccac1207128e82255974eea7bb2c5930308e8383e97ddb8ee501f5816e6082bd8556cfa45c5f50
- SSDEEP
  
  384:IftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5z6l0Oy5o917aPjpg82vG:IW7zxAmpfyCz6pVQ5Pho9UPju82e
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2