chaos | fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5[.]zip

General

Target
fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5.zip
Size 13KB
Sample250323-g26k5awkx8
SHA256 1edd290ace5bbaa0accd43b04495e88149a739836b628b803e6285a6f85ccd9e
MD5 619f5922e258e6191ee53f1cf3cc3512
SHA1 0d9fe876558b8d7cdfffdbfc210b29c331f1ea67
SHA512 25ac0e3b8e5950d3dcc987382f3ede8ac67055dfa73e8055d911cc8e29900524006cfda41c4325da35a81904053d41017a26c6662ad6755671804f5144e7898f
SSDEEP 384:Jz/CRYAcAOJaO+QhluA4bPX3E72lU7DoyP3xoGar8:lWPcAOJZ+QhluA4bPUQU7D7aGar8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/yea.exe	family_chaos

Chaos family
chaos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/yea.exe

File Explorer

fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5.zip

.zip 13KB
yea.exe

.exe 27KB

fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5.zip

SHA256 1edd290ace5bbaa0accd43b04495e88149a739836b628b803e6285a6f85ccd9e
MD5 619f5922e258e6191ee53f1cf3cc3512
SHA1 0d9fe876558b8d7cdfffdbfc210b29c331f1ea67
SHA512 25ac0e3b8e5950d3dcc987382f3ede8ac67055dfa73e8055d911cc8e29900524006cfda41c4325da35a81904053d41017a26c6662ad6755671804f5144e7898f
SSDEEP 384:Jz/CRYAcAOJaO+QhluA4bPX3E72lU7DoyP3xoGar8:lWPcAOJZ+QhluA4bPUQU7D7aGar8
MD5 SHA1 SHA512 SSDEEP

Password

infected

yea.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5
MD5 d0fedfe9df8f5440847a57e531262e0e
SHA1 78ffb5eaa655ba8d4e7f869d012f347a07d1eaa6
SHA512 94941cbd9dd1ca3aef125ae502368a5bf9f8a193662f621e12736047db1b31b9b09646b48e4a3a5114da125b22436adb276ff92ebac339269f1084f22c14ecf7
SSDEEP 384:LtWZPzzxAm1vS5ZooqYEWx0noBeuBb6llVOy5o91Ep+82vz:C7zxAmOS/Y70nWeu1Cho9uw82L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Chaos Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

33550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5.zip

yea.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

fbc39e38d112f99731151a8e2dc19765cdc18150109064c0df6f6a61bbbdf4e5.zip

yea.exe

mscoree

dotnet