chaos

General

Target

2025-02-03_b0023cb3b90d814bde6095efe0af2ca2_destroyer_wannacry
Size

27KB
Sample

250203-2glensxncq
MD5

b0023cb3b90d814bde6095efe0af2ca2
SHA1

340296955b00717a376748798ceda4e215999583
SHA256

d7e14b344eabeb0a8ab48bfaa6e7e74899b925091c36ba783e38f8da8dcd4df4
SHA512

ca184f5bc09ee707a520657551db486b1d71726e71e4f450ba42b519010738fcbe2c2d1af8edc64323d79bdac7f0b3709e372ab8ac297ebf5f9bf9569e880c56
SSDEEP

384:mFftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5nelEOy5o91lDM5sp/82vG:mFW7zxAmpfyCz6pVQ5fho9kGR82+

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2025-02-03_b0023cb3b90d814bde6095efe0af2ca2_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  b0023cb3b90d814bde6095efe0af2ca2
- SHA1
  
  340296955b00717a376748798ceda4e215999583
- SHA256
  
  d7e14b344eabeb0a8ab48bfaa6e7e74899b925091c36ba783e38f8da8dcd4df4
- SHA512
  
  ca184f5bc09ee707a520657551db486b1d71726e71e4f450ba42b519010738fcbe2c2d1af8edc64323d79bdac7f0b3709e372ab8ac297ebf5f9bf9569e880c56
- SSDEEP
  
  384:mFftWZPzzxAm1vp5ZRoDCFKW6pAnAQ5nelEOy5o91lDM5sp/82vG:mFW7zxAmpfyCz6pVQ5fho9kGR82+
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2