Overview

overview

10

Static

static

10

2025-03-29...ry.exe

windows7-x64

10

2025-03-29...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry

  • Size

    28KB

  • Sample

    250329-1hz4satyct

  • MD5

    5cbae06a1b1876d43eddfde3dd8409eb

  • SHA1

    67d71c6a4811cc8ab6c1ff60f764ab6ca655e8a8

  • SHA256

    39233ea5a96b17c0f8cfc3341705120fbbac7d274d9d408b660d2c61ba5b7771

  • SHA512

    ec16edc0824c5aece50a88aa726e026cb1b7b9642694ed46fb985552e59296984a6415816577a6ad9adcc66dcdd6896b7adf42f9dfcbdded49828d61c0799485

  • SSDEEP

    384:iYenjLLAvS6FidaaKcgwof52OVp912TXZxDGKr:BKRoaKcgwVc9MTpxDZ

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry

    • Size

      28KB

    • MD5

      5cbae06a1b1876d43eddfde3dd8409eb

    • SHA1

      67d71c6a4811cc8ab6c1ff60f764ab6ca655e8a8

    • SHA256

      39233ea5a96b17c0f8cfc3341705120fbbac7d274d9d408b660d2c61ba5b7771

    • SHA512

      ec16edc0824c5aece50a88aa726e026cb1b7b9642694ed46fb985552e59296984a6415816577a6ad9adcc66dcdd6896b7adf42f9dfcbdded49828d61c0799485

    • SSDEEP

      384:iYenjLLAvS6FidaaKcgwof52OVp912TXZxDGKr:BKRoaKcgwVc9MTpxDZ

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks