chaos

General

Target

2025-02-01_ae3d912081d1ed9e0e103290d2aa14a5_destroyer_wannacry
Size

72KB
Sample

250201-y7119s1jal
MD5

ae3d912081d1ed9e0e103290d2aa14a5
SHA1

ca0b14020a16a418e9480d557c7f6f009210f3d7
SHA256

4954b1413717c7e81ad5e75f68b9eba2f4bc5e30b2647b7725828170a0988efa
SHA512

3e335153f2872733ad733d45c8a00d94a2b5c924e2f2b8149a84b3abdfbde1257dd21c9af4c4d8f6c49400fbffdf3319759fbf2bdfd805a4ef5725c031aba4f6
SSDEEP

1536:4NoPN267q90a6XLX3ixLklrvmPzYxAfcwBgpGWshaqFcQRbHF49Z:f17q90a6TSdklyrRcyusNzNHo

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail : [email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected] ) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2025-02-01_ae3d912081d1ed9e0e103290d2aa14a5_destroyer_wannacry
- Size
  
  72KB
- MD5
  
  ae3d912081d1ed9e0e103290d2aa14a5
- SHA1
  
  ca0b14020a16a418e9480d557c7f6f009210f3d7
- SHA256
  
  4954b1413717c7e81ad5e75f68b9eba2f4bc5e30b2647b7725828170a0988efa
- SHA512
  
  3e335153f2872733ad733d45c8a00d94a2b5c924e2f2b8149a84b3abdfbde1257dd21c9af4c4d8f6c49400fbffdf3319759fbf2bdfd805a4ef5725c031aba4f6
- SSDEEP
  
  1536:4NoPN267q90a6XLX3ixLklrvmPzYxAfcwBgpGWshaqFcQRbHF49Z:f17q90a6TSdklyrRcyusNzNHo
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2