chaos

General

Target

SatanCD.exe
Size

132KB
Sample

250108-kf8edavkeq
MD5

9c5ade58e1670dacf3a8ec7f695ce1f9
SHA1

fe99bc290ae1f0eadb34c558bcf313077f154d57
SHA256

1f6c05feabe71f2d0236fd74faf1243bcaac0c9b70e51a0e718988f088b138fb
SHA512

90fbc2b7b8a1a8347e1a6fd23649e113ed4ed9e95c5d2fae9ca5895615dd8f6621546a2a8a5a3b1cdba6e6ecd8fb48337250d281ea5b5bf12c5b2ff8ec9c23d0
SSDEEP

3072:2okosr98I9wIe3330+hbC7rOwyXS6XNmnqCbU47IRv:ar98IqIenf6LYNQW

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Warning.txt

Ransom Note

Your files has been encrypted By SatanCD and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $5,063 can be made in bitcoin only Please Contact Us At Gmail: [email protected] Or Join us in Private Chat http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room PIN: 366 But First off Please Install Tor browser: https://www.torproject.org/download/ Payment information Amount: 0.053 BTC Bitcoin Address: bc1qcvgj0hxslrxpf6e969ay577t9g72dd663fus92

Emails

[email protected]

URLs

http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room

Targets

- Target
  
  SatanCD.exe
- Size
  
  132KB
- MD5
  
  9c5ade58e1670dacf3a8ec7f695ce1f9
- SHA1
  
  fe99bc290ae1f0eadb34c558bcf313077f154d57
- SHA256
  
  1f6c05feabe71f2d0236fd74faf1243bcaac0c9b70e51a0e718988f088b138fb
- SHA512
  
  90fbc2b7b8a1a8347e1a6fd23649e113ed4ed9e95c5d2fae9ca5895615dd8f6621546a2a8a5a3b1cdba6e6ecd8fb48337250d281ea5b5bf12c5b2ff8ec9c23d0
- SSDEEP
  
  3072:2okosr98I9wIe3330+hbC7rOwyXS6XNmnqCbU47IRv:ar98IqIenf6LYNQW
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (237) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1