chaos | 7ffda7a528e38c732f639deda80f9200a30e00f111b2ff43726ee9461797e35a

General

Target
2026-07-14_485b430cd68cd02547da5f328d78e94a_destroyer_elex_glassworm_wannacry
Size 34KB
Sample260714-y2bjesc15r
SHA256 7ffda7a528e38c732f639deda80f9200a30e00f111b2ff43726ee9461797e35a
MD5 485b430cd68cd02547da5f328d78e94a
SHA1 18a5a51e3ca11670c92c9d2e4b90ea9fa48effa3
SHA512 9a17ea25837149618091b0954848a12f06c503351c5c331797f7fe6e5ef9f576264d0a6701446605be0aab643e75d1d7b931a327edfa99940ed9aba956d703f4
SSDEEP 768:t7zxAm3zb370Oeu1Rho9Ed82gsROfd5ALgY:tN3voOe6Rq9EiRsD
TLSH
T15DF2290577F94636FAFF9F7C68F151024B76B952DC29D68E188D40890D22B8C8DA07BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\HOW TO RECOVER FILES.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

Targets

- Target
  2026-07-14_485b430cd68cd02547da5f328d78e94a_destroyer_elex_glassworm_wannacry
- Size 34KB
- SHA256 7ffda7a528e38c732f639deda80f9200a30e00f111b2ff43726ee9461797e35a
- MD5 485b430cd68cd02547da5f328d78e94a
- SHA1 18a5a51e3ca11670c92c9d2e4b90ea9fa48effa3
- SHA512 9a17ea25837149618091b0954848a12f06c503351c5c331797f7fe6e5ef9f576264d0a6701446605be0aab643e75d1d7b931a327edfa99940ed9aba956d703f4
- SSDEEP 768:t7zxAm3zb370Oeu1Rho9Ed82gsROfd5ALgY:tN3voOe6Rq9EiRsD
- TLSH
  T15DF2290577F94636FAFF9F7C68F151024B76B952DC29D68E188D40890D22B8C8DA07BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (355) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2