chaos

General

Target

BloodEagle Ransomware Builder.exe
Size

683KB
Sample

250328-han3favkx7
MD5

bd74ac3a184b41087eaffe1c4e5575f1
SHA1

dcf0cc5cf9d633f398bda7821bb04b89ac60870d
SHA256

87675dc68eac28c09af5658389267f7160d34865aaa4d2abaf4f127432333bcc
SHA512

bed0db9ed78e0459b151849b6c04ed626a664b6779fdce3b5ccdced5dc06c2eea208b08dc1cf153a6781587c45fba3d92a8f5a27952c58fcace27330a75d9526
SSDEEP

3072:hL6xoPurnfsj7A0H7GMgXuD//bFLAkC3IGYWEyNakhm5Zt1HrTM/rFLjZkJ:8kj0aGMVFLQJPJUEFL2

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  BloodEagle Ransomware Builder.exe
- Size
  
  683KB
- MD5
  
  bd74ac3a184b41087eaffe1c4e5575f1
- SHA1
  
  dcf0cc5cf9d633f398bda7821bb04b89ac60870d
- SHA256
  
  87675dc68eac28c09af5658389267f7160d34865aaa4d2abaf4f127432333bcc
- SHA512
  
  bed0db9ed78e0459b151849b6c04ed626a664b6779fdce3b5ccdced5dc06c2eea208b08dc1cf153a6781587c45fba3d92a8f5a27952c58fcace27330a75d9526
- SSDEEP
  
  3072:hL6xoPurnfsj7A0H7GMgXuD//bFLAkC3IGYWEyNakhm5Zt1HrTM/rFLjZkJ:8kj0aGMVFLQJPJUEFL2
Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1