chaos

General

Target

Yashma ransomware builder v1.2.exe
Size

825KB
Sample

241204-cf2yla1nep
MD5

5120e2ada300c2eef255957dde5b84b0
SHA1

dfb5c0b29fb235d34e851de234535474705be356
SHA256

b24d58cd8d600431702b67fb815a92f465147553303c0f8a1867af77214dba75
SHA512

958f089a7060188213dd00f6d73bbd625a89f98ccc0b5bf7b5963a3ef40677846e03a33866b79cec92fd29709ff8f0bd9a753397ef07f25779aedb02884d9f8c
SSDEEP

6144:aMPUfX5X2onFLfFLzFL6FL6aGMVFLQ+FWD/:aLJX8QD

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  Yashma ransomware builder v1.2.exe
- Size
  
  825KB
- MD5
  
  5120e2ada300c2eef255957dde5b84b0
- SHA1
  
  dfb5c0b29fb235d34e851de234535474705be356
- SHA256
  
  b24d58cd8d600431702b67fb815a92f465147553303c0f8a1867af77214dba75
- SHA512
  
  958f089a7060188213dd00f6d73bbd625a89f98ccc0b5bf7b5963a3ef40677846e03a33866b79cec92fd29709ff8f0bd9a753397ef07f25779aedb02884d9f8c
- SSDEEP
  
  6144:aMPUfX5X2onFLfFLzFL6FL6aGMVFLQ+FWD/:aLJX8QD
Score

10^/10

chaos ransomware defense_evasion evasion execution impact persistence spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2