Overview

overview

10

Static

static

10

svhost.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svhost.exe

  • Size

    22KB

  • Sample

    241215-cmb1ra1mbz

  • MD5

    54bcbd6d45bc3bc155576d759f1a6ae6

  • SHA1

    c9fcbd1ac3c48f41f17920d63dd03fef6adeba27

  • SHA256

    eab0b70f3de7f7d5be417a5e03d293e652d403f363b39d30f73c53f2672af434

  • SHA512

    b93de78e72cc012b9bd719b767e8d4dc0ee4dec81ecd102d984b6f80470da38da1c911e2c169e1d4b7a7ad9e0e96487aff71f24239196c52480217c4c9fb761d

  • SSDEEP

    384:k3Mg/bqo2OhGv+2jAp6AnXNdd10JFr91CT7d5eH:aqo2Nv4p/ndlcFr9QHeH

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      svhost.exe

    • Size

      22KB

    • MD5

      54bcbd6d45bc3bc155576d759f1a6ae6

    • SHA1

      c9fcbd1ac3c48f41f17920d63dd03fef6adeba27

    • SHA256

      eab0b70f3de7f7d5be417a5e03d293e652d403f363b39d30f73c53f2672af434

    • SHA512

      b93de78e72cc012b9bd719b767e8d4dc0ee4dec81ecd102d984b6f80470da38da1c911e2c169e1d4b7a7ad9e0e96487aff71f24239196c52480217c4c9fb761d

    • SSDEEP

      384:k3Mg/bqo2OhGv+2jAp6AnXNdd10JFr91CT7d5eH:aqo2Nv4p/ndlcFr9QHeH

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks