chaos

General

Target

2025-01-22_b91edc9a88f5594fefc736db0269eb72_destroyer_wannacry
Size

27KB
Sample

250122-qn5w4syjcv
MD5

b91edc9a88f5594fefc736db0269eb72
SHA1

3be3378fb44541dafb1771184ef65339c0406b83
SHA256

b77060ede73003ffba13c286c44dd0ef8c5b1bb7437df6c9544cc435fe3aa4d4
SHA512

ade74383b26a9636ab405cf7e46a1680dc163b9d85345fdfd939816b0044b1cf98aa9fc59925fba9a48f3601e7b82276b0c401dcb7066a8ff87f12f8157c882a
SSDEEP

384:QJtvVCneCtqpR86DagyzemwbZ2oz/ZmO5xNhS6U1G:utdfCIA6HbJowu1G

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

YOUR FILES HAVE BEEN ENCRYPTED!!! Don't worry, you can have your files returned. All your files like documents, photos, databases and other important are encrypted You must follow these steps To decrypt your files with in 6 Hours. Send 2 BTC to, bc1q9rvwt772dm79pdnk6syx25wnnh8khrqppj55rk Once we receive the BTC and its safe, we will send you a decryption key. WARNING: Tampering with the encryption or any attempt to decrypt any file will result in COMPLETE destruction of your data which will be on you!!! TICK TOCK!!!

Targets

- Target
  
  2025-01-22_b91edc9a88f5594fefc736db0269eb72_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  b91edc9a88f5594fefc736db0269eb72
- SHA1
  
  3be3378fb44541dafb1771184ef65339c0406b83
- SHA256
  
  b77060ede73003ffba13c286c44dd0ef8c5b1bb7437df6c9544cc435fe3aa4d4
- SHA512
  
  ade74383b26a9636ab405cf7e46a1680dc163b9d85345fdfd939816b0044b1cf98aa9fc59925fba9a48f3601e7b82276b0c401dcb7066a8ff87f12f8157c882a
- SSDEEP
  
  384:QJtvVCneCtqpR86DagyzemwbZ2oz/ZmO5xNhS6U1G:utdfCIA6HbJowu1G
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2