chaos | 6cd909d54d056abde6b9395996ad3c63fc3fcc46097738fbac75234112e93b2e

General

Target
2026-07-16_958476f147244cc5ac047b649fa1bf5f_destroyer_elex_glassworm_wannacry
Size 73KB
Sample260716-2bd4eaaw7t
SHA256 6cd909d54d056abde6b9395996ad3c63fc3fcc46097738fbac75234112e93b2e
MD5 958476f147244cc5ac047b649fa1bf5f
SHA1 0dc8dd234bf3bc58762132b83dae82327ef12c5d
SHA512 1298a9b5a5d37d30b0ab88ac56d34e0a5005ae249c606aa7d0c7c5b0a1ae6bcf9d635a0b5b62a49f1282444155c2d99d0e5c369caddc77b2510ae3e0adb0c9b1
SSDEEP 1536:qo2sxEur907B9eyfpOMrzXkL5MVka2WyCVMz5aEWf:qohxEur907BfgM0OBPyP5aE+
TLSH
T13873756439FB401DF1B3AEBC5BE4709E896BFA672D0A945D1041024A4672F4DDF83B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com [email protected] Payment informationAmount: 0.0990 BTC Bitcoin Address: 0xcb7dbbe31fbc053ca0b519aa0f0a2d63d6367322

Emails

[email protected]

Targets

- Target
  2026-07-16_958476f147244cc5ac047b649fa1bf5f_destroyer_elex_glassworm_wannacry
- Size 73KB
- SHA256 6cd909d54d056abde6b9395996ad3c63fc3fcc46097738fbac75234112e93b2e
- MD5 958476f147244cc5ac047b649fa1bf5f
- SHA1 0dc8dd234bf3bc58762132b83dae82327ef12c5d
- SHA512 1298a9b5a5d37d30b0ab88ac56d34e0a5005ae249c606aa7d0c7c5b0a1ae6bcf9d635a0b5b62a49f1282444155c2d99d0e5c369caddc77b2510ae3e0adb0c9b1
- SSDEEP 1536:qo2sxEur907B9eyfpOMrzXkL5MVka2WyCVMz5aEWf:qohxEur907BfgM0OBPyP5aE+
- TLSH
  T13873756439FB401DF1B3AEBC5BE4709E896BFA672D0A945D1041024A4672F4DDF83B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (464) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2