chaos

General

Target

SatanCDD.exe
Size

5.1MB
Sample

250109-dsyx5swkgv
MD5

1f412d7ed012129b47265ac1512a9263
SHA1

2fbec7ec4f095162c56d9c2e1d683dbd628e2677
SHA256

a7453470f9d99e93cc51b7a8481ee27a87f9f0600eb4593a3336e7064687bbe1
SHA512

8392abf0cf10b1279364bdfa2eed542523e3a79d0b173745dcc9ec2f64845f5001ca902f4d0bc0e7088ec392e81d0a05501c81bb4a901136e167868deb096307
SSDEEP

98304:19YWrObgEeQYyQaXf1X9RcSg2lcouStL2xW7F5Q7b5sAYrlpthc7:19fAeQXQaV9RcHucouSt/jQv5sAql7hO

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Warning.txt

Ransom Note

Your files has been encrypted By SatanCD and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $5,063 can be made in bitcoin only Please Contact Us At Gmail: [email protected] Or Join us in Private Chat http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room PIN: 366 But First off Please Install Tor browser: https://www.torproject.org/download/ Payment information Amount: 0.053 BTC Bitcoin Address: bc1qcvgj0hxslrxpf6e969ay577t9g72dd663fus92

Emails

[email protected]

URLs

http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room

Targets

- Target
  
  SatanCDD.exe
- Size
  
  5.1MB
- MD5
  
  1f412d7ed012129b47265ac1512a9263
- SHA1
  
  2fbec7ec4f095162c56d9c2e1d683dbd628e2677
- SHA256
  
  a7453470f9d99e93cc51b7a8481ee27a87f9f0600eb4593a3336e7064687bbe1
- SHA512
  
  8392abf0cf10b1279364bdfa2eed542523e3a79d0b173745dcc9ec2f64845f5001ca902f4d0bc0e7088ec392e81d0a05501c81bb4a901136e167868deb096307
- SSDEEP
  
  98304:19YWrObgEeQYyQaXf1X9RcSg2lcouStL2xW7F5Q7b5sAYrlpthc7:19fAeQXQaV9RcHucouSt/jQv5sAql7hO
Score

10^/10

chaos defense_evasion evasion execution impact pyinstaller ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (188) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1