chaos

General

Target

2025-01-31_3141e9897f750c7b5d0b51f644d63010_destroyer_wannacry
Size

35KB
Sample

250131-g8qs9aypey
MD5

3141e9897f750c7b5d0b51f644d63010
SHA1

812e7fb43952d07ea7b29f0f8e3406d408b56e77
SHA256

e86124d645258b8c4ae50bb4b8c93f3cfd8130b161ed7526bded020065e986f4
SHA512

67297eefd2d3a901abc2421cc762e08866ea4519bf191ddf765ee6949421feb8b2f37f3b414d7cbb5669cf26782ff7eb1541c6dcbf2815b196de8e3b1143c3af
SSDEEP

768:wqo2lMDFxp0DFN0/r9cZ3fcx6SOBLiIYpqLQndtg/xeo:Xo2SahN0/r9cRcISO7Lgda/Ao

Score

10^/10

Malware Config

Targets

- Target
  
  2025-01-31_3141e9897f750c7b5d0b51f644d63010_destroyer_wannacry
- Size
  
  35KB
- MD5
  
  3141e9897f750c7b5d0b51f644d63010
- SHA1
  
  812e7fb43952d07ea7b29f0f8e3406d408b56e77
- SHA256
  
  e86124d645258b8c4ae50bb4b8c93f3cfd8130b161ed7526bded020065e986f4
- SHA512
  
  67297eefd2d3a901abc2421cc762e08866ea4519bf191ddf765ee6949421feb8b2f37f3b414d7cbb5669cf26782ff7eb1541c6dcbf2815b196de8e3b1143c3af
- SSDEEP
  
  768:wqo2lMDFxp0DFN0/r9cZ3fcx6SOBLiIYpqLQndtg/xeo:Xo2SahN0/r9cRcISO7Lgda/Ao
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (212) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2