General
-
Target
http://gofile.io/d/SUUz1d
-
Sample
250315-1hvt3atydx
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://gofile.io/d/SUUz1d
Resource
win11-20250313-en
31 signatures
900 seconds
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\read_it.txt
Ransom Note
All of your files have been encrypted
Your computer was infected with a ransomware virus. Your files have been encrypted and you won't
be able to decrypt them without our help.What can I do to get my files back?You can buy our special
decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.The price for the software is $130. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Exodus- exodus.com
Payment informationAmount: 0.00155 BTC
Bitcoin Address:
Targets
-
-
Target
http://gofile.io/d/SUUz1d
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1