chaos

General

Target

2024-12-08_038b7f3b1e74984be422d1b51c4cc110_destroyer_wannacry
Size

27KB
Sample

241208-f3w8eazkcl
MD5

038b7f3b1e74984be422d1b51c4cc110
SHA1

95bc007d6165e4571b80fb0859905fe1d6f2b777
SHA256

d9f317d3b907550f8099b299760db20e625853255640458fcb195aa0f255cd30
SHA512

9ee50e880bf1322aa2910e33588051f8a08540e4f72f6be39af61749939742170050fa251bb37c6a0164cde2991ca3fed74fdec255d4a2829bffac18fe688fbf
SSDEEP

384:57tWZPzzxAm1vp5ZRoDPpjCG/N/y8xlHOy5o91+Doupp82vh:5S7zxAmpfyYG/0Qho9wDB/825

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-12-08_038b7f3b1e74984be422d1b51c4cc110_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  038b7f3b1e74984be422d1b51c4cc110
- SHA1
  
  95bc007d6165e4571b80fb0859905fe1d6f2b777
- SHA256
  
  d9f317d3b907550f8099b299760db20e625853255640458fcb195aa0f255cd30
- SHA512
  
  9ee50e880bf1322aa2910e33588051f8a08540e4f72f6be39af61749939742170050fa251bb37c6a0164cde2991ca3fed74fdec255d4a2829bffac18fe688fbf
- SSDEEP
  
  384:57tWZPzzxAm1vp5ZRoDPpjCG/N/y8xlHOy5o91+Doupp82vh:5S7zxAmpfyYG/0Qho9wDB/825
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2