chaos

Resubmissions

10/10/2025, 20:59

251010-zsqsestk1910

10/10/2025, 20:58

10/10/2025, 20:58

09/04/2025, 16:07

08/04/2025, 19:38

12/03/2025, 19:44

18/02/2025, 01:38

Sharing

Copy URL Twitter E-mail

General

Target
N3OR4NS0M.exe
Size 117KB
Sample250312-yf71hasnt8
SHA256 25fba19a79ca6ef0c1f8b092c8f6e0cb4ac91239089b2764f73bf59c29a544ef
MD5 0772d9df47836609fbfdd95ce144b683
SHA1 2cfe3bebd9c1eda6f8478dd6f8271b42ddcba7c6
SHA512 86631a262c35324091fdbbffc5499b60b69d37b41496bd8b52fe85355c97ca07f6005e02eef4244622b4dd7659c9effa560e5ca3afb4f0f98ed2d3af6b062b86
SSDEEP 3072:1oyESEKr9zTg9RUa2WgSEBYBEHgX0oz15WXf:XNr9zToN2WfNX0ozvq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  N3OR4NS0M.exe
- Size 117KB
- SHA256 25fba19a79ca6ef0c1f8b092c8f6e0cb4ac91239089b2764f73bf59c29a544ef
- MD5 0772d9df47836609fbfdd95ce144b683
- SHA1 2cfe3bebd9c1eda6f8478dd6f8271b42ddcba7c6
- SHA512 86631a262c35324091fdbbffc5499b60b69d37b41496bd8b52fe85355c97ca07f6005e02eef4244622b4dd7659c9effa560e5ca3afb4f0f98ed2d3af6b062b86
- SSDEEP 3072:1oyESEKr9zTg9RUa2WgSEBYBEHgX0oz15WXf:XNr9zToN2WfNX0ozvq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

chaos hawkeye defense_evasion evasion execution impact keylogger ransomware spyware stealer trojan
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (214) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4