chaos

General

Target

2025-01-29_0a0d4b96e2890dbd74d9c350251209e5_destroyer_wannacry
Size

27KB
Sample

250129-2bzecazmcn
MD5

0a0d4b96e2890dbd74d9c350251209e5
SHA1

2d93384d5a3bbe8f91fdc13815ea6bc61381d69f
SHA256

42aa3a06c1c3b44b45e4e0c06638e52019e60f868244dd675d11c2cbfbd28ace
SHA512

e7b6b0de1ddcc0f14509e4c55685ebe5ea907c311e1cc23d03316220099bd849e2e274b8631a1db3adb22e7a47116f4274e81f5301154e3dbb0faed03210b6c5
SSDEEP

384:itWZPzzxAm1vS5ZooqYEWx0noBeuBbkblOOy5o91s2h7Vp7U82vZ:n7zxAmOS/Y70nWeu19ho9lhxpU82R

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2025-01-29_0a0d4b96e2890dbd74d9c350251209e5_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  0a0d4b96e2890dbd74d9c350251209e5
- SHA1
  
  2d93384d5a3bbe8f91fdc13815ea6bc61381d69f
- SHA256
  
  42aa3a06c1c3b44b45e4e0c06638e52019e60f868244dd675d11c2cbfbd28ace
- SHA512
  
  e7b6b0de1ddcc0f14509e4c55685ebe5ea907c311e1cc23d03316220099bd849e2e274b8631a1db3adb22e7a47116f4274e81f5301154e3dbb0faed03210b6c5
- SSDEEP
  
  384:itWZPzzxAm1vS5ZooqYEWx0noBeuBbkblOOy5o91s2h7Vp7U82vZ:n7zxAmOS/Y70nWeu19ho9lhxpU82R
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2