chaos

General

Target

2025-02-12_5464b1193f7979e121da4b48323a263f_wannacry
Size

132KB
Sample

250212-2zh29szna1
MD5

5464b1193f7979e121da4b48323a263f
SHA1

4206ba97e8de89d47cdab4441e10829d9ae0f69e
SHA256

37e67d7687cbab77fd57096bbbd31ec2491f293a4e39d04ee0247109030a611a
SHA512

1b5f02952d985360f7a173501fba4900712b1381ef3ddff48891c5b1ba44f7d25690670da26865e576952a5c0f656d4803444bd1390eafe903817f41ef48e1d6
SSDEEP

1536:I3kIowImQr9i9L8PHzbSIS0bvB2GsMTUhdo0Bon8:I3kBmQr9i9LEbDvB2GsMTUhdo0Bo

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: 196uiHAt1nC4Gch5SDLV14DMfZg8DxDAui

Wallets

196uiHAt1nC4Gch5SDLV14DMfZg8DxDAui

Targets

- Target
  
  2025-02-12_5464b1193f7979e121da4b48323a263f_wannacry
- Size
  
  132KB
- MD5
  
  5464b1193f7979e121da4b48323a263f
- SHA1
  
  4206ba97e8de89d47cdab4441e10829d9ae0f69e
- SHA256
  
  37e67d7687cbab77fd57096bbbd31ec2491f293a4e39d04ee0247109030a611a
- SHA512
  
  1b5f02952d985360f7a173501fba4900712b1381ef3ddff48891c5b1ba44f7d25690670da26865e576952a5c0f656d4803444bd1390eafe903817f41ef48e1d6
- SSDEEP
  
  1536:I3kIowImQr9i9L8PHzbSIS0bvB2GsMTUhdo0Bon8:I3kBmQr9i9LEbDvB2GsMTUhdo0Bo
Score

10^/10

chaos ransomware spyware stealer discovery
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2