chaos

General

Target

2025-01-12_35cbe9edd460f2528f7ad41907410178_destroyer_wannacry
Size

27KB
Sample

250112-yg4pgawpat
MD5

35cbe9edd460f2528f7ad41907410178
SHA1

7a9e5ffad5c86238e16284f89ae2a7538ebbd98c
SHA256

b075dac85f310b39eda3d3b7f931c750b83a15cfa123cfe8546e5154ae3ae22c
SHA512

283538c001dc6722a8612f4c544ab6fffe157e57a786bbb3b4ebc0e4dbf3a87f9b0e0906c3f647b529f93e6d8ea9256d29d56bca7f1e114b4424de04af483263
SSDEEP

384:jDtWZPzzxAm1vp5ZRoDMS74WtRQUxhhlsNpGLWlUOy5o91izp882vc:j67zxAmpfyMS1RQUxGN4Lho9Ie82k

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2025-01-12_35cbe9edd460f2528f7ad41907410178_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  35cbe9edd460f2528f7ad41907410178
- SHA1
  
  7a9e5ffad5c86238e16284f89ae2a7538ebbd98c
- SHA256
  
  b075dac85f310b39eda3d3b7f931c750b83a15cfa123cfe8546e5154ae3ae22c
- SHA512
  
  283538c001dc6722a8612f4c544ab6fffe157e57a786bbb3b4ebc0e4dbf3a87f9b0e0906c3f647b529f93e6d8ea9256d29d56bca7f1e114b4424de04af483263
- SSDEEP
  
  384:jDtWZPzzxAm1vp5ZRoDMS74WtRQUxhhlsNpGLWlUOy5o91izp882vc:j67zxAmpfyMS1RQUxGN4Lho9Ie82k
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2