chaos

General

Target

2025-02-21_e9cd337f5a8c2e65b8ac6e27593af184_destroyer_wannacry
Size

59KB
Sample

250221-ngqgqs1mfn
MD5

e9cd337f5a8c2e65b8ac6e27593af184
SHA1

f28caa61be74d34334837447cb727559ffc2aeb9
SHA256

1eb024838ac5cc347fc5e318e98f69c5866dc102669af8d7ba07b87895e61f64
SHA512

18fc6c8152dc9e896e8d44ceb5601ca2844c07d3809b54f017f3279b6282e79e1e93098ce83434742e54fde148f3bdc2d167566de22f2a456f32809445cae1ae
SSDEEP

1536:tF2AxIc9SA7oC2IFNR7jwYkh2sdN3GMyry:6QIc9SZC2Iv9jwYU/3GM

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-21_e9cd337f5a8c2e65b8ac6e27593af184_destroyer_wannacry
- Size
  
  59KB
- MD5
  
  e9cd337f5a8c2e65b8ac6e27593af184
- SHA1
  
  f28caa61be74d34334837447cb727559ffc2aeb9
- SHA256
  
  1eb024838ac5cc347fc5e318e98f69c5866dc102669af8d7ba07b87895e61f64
- SHA512
  
  18fc6c8152dc9e896e8d44ceb5601ca2844c07d3809b54f017f3279b6282e79e1e93098ce83434742e54fde148f3bdc2d167566de22f2a456f32809445cae1ae
- SSDEEP
  
  1536:tF2AxIc9SA7oC2IFNR7jwYkh2sdN3GMyry:6QIc9SZC2Iv9jwYU/3GM
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (190) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2