chaos

General

Target

2024-12-07_111fc4f48385771ba64e3ddeed0641e9_destroyer_wannacry
Size

59KB
Sample

241207-sr4jka1nhp
MD5

111fc4f48385771ba64e3ddeed0641e9
SHA1

9506687750996fda9d36b492dba8727779c37f18
SHA256

42930c48079c620a1b0a2353e1456748b544c1f2d3a389bbca8539dec227b559
SHA512

469d74b56270d10f623cb60a00553b6819dcd778977cff97801d35e4ca85fca1da0f4cd5a8de73ce5888adf52d4d7114b36d94e7b0076c92886b40e9c8680e2f
SSDEEP

1536:QNNma7BSijq9anZCIjxiCG6q86fO+HVwa/eW/oXEat:qmEjq9sc6ACt62+HDWXV

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]. 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-12-07_111fc4f48385771ba64e3ddeed0641e9_destroyer_wannacry
- Size
  
  59KB
- MD5
  
  111fc4f48385771ba64e3ddeed0641e9
- SHA1
  
  9506687750996fda9d36b492dba8727779c37f18
- SHA256
  
  42930c48079c620a1b0a2353e1456748b544c1f2d3a389bbca8539dec227b559
- SHA512
  
  469d74b56270d10f623cb60a00553b6819dcd778977cff97801d35e4ca85fca1da0f4cd5a8de73ce5888adf52d4d7114b36d94e7b0076c92886b40e9c8680e2f
- SSDEEP
  
  1536:QNNma7BSijq9anZCIjxiCG6q86fO+HVwa/eW/oXEat:qmEjq9sc6ACt62+HDWXV
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2