chaos | 045ffdf9bfbad3ab7ae3cd6cae296b5a0a1b0b29b48c9ac536a0a80e4dd373b1

General

Target
2026-07-15_9588cad37921307fb5985de792324f0e_destroyer_elex_glassworm_wannacry
Size 66KB
Sample260715-g4hbbadv2q
SHA256 045ffdf9bfbad3ab7ae3cd6cae296b5a0a1b0b29b48c9ac536a0a80e4dd373b1
MD5 9588cad37921307fb5985de792324f0e
SHA1 f6a5ccc9c08670380fe1dc6200fc7a05ba8a6ddf
SHA512 c500f29f6400481f227c313a00179e90a6f54dcaf4ab75c102ba13413461402a7f4f71e1cdade634029a8b057a2635a45497d94df0ff429d3f54b34435918022
SSDEEP 1536:ko2sxEur907B9eyfpOMrzXkL5MVka2WyCVMz5a:kohxEur907BfgM0OBPyP5a
TLSH
T11063446439FB401DF1B3AEBC5BE4719E896BFA272D0A945D1041024A4672F4DDF83B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com [email protected] Payment informationAmount: 0.0990 BTC Bitcoin Address: 0xcb7dbbe31fbc053ca0b519aa0f0a2d63d6367322

Emails

[email protected]

Targets

- Target
  2026-07-15_9588cad37921307fb5985de792324f0e_destroyer_elex_glassworm_wannacry
- Size 66KB
- SHA256 045ffdf9bfbad3ab7ae3cd6cae296b5a0a1b0b29b48c9ac536a0a80e4dd373b1
- MD5 9588cad37921307fb5985de792324f0e
- SHA1 f6a5ccc9c08670380fe1dc6200fc7a05ba8a6ddf
- SHA512 c500f29f6400481f227c313a00179e90a6f54dcaf4ab75c102ba13413461402a7f4f71e1cdade634029a8b057a2635a45497d94df0ff429d3f54b34435918022
- SSDEEP 1536:ko2sxEur907B9eyfpOMrzXkL5MVka2WyCVMz5a:kohxEur907BfgM0OBPyP5a
- TLSH
  T11063446439FB401DF1B3AEBC5BE4719E896BFA272D0A945D1041024A4672F4DDF83B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (412) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2