chaos | cdae656cb548e98170535717b32ccbf04cab31ca9de9882cc5d6262744175562

General

Target
2026-07-17_a2270ead2e06964c74d3edae58f2472a_destroyer_elex_glassworm_wannacry
Size 56KB
Sample260717-ms8a9acz7v
SHA256 cdae656cb548e98170535717b32ccbf04cab31ca9de9882cc5d6262744175562
MD5 a2270ead2e06964c74d3edae58f2472a
SHA1 fbfbcf61a954872f8090b3a979201c3522b39cb7
SHA512 44555896dbf41c74952d3f7721a3e94b9fa0a7d1c4ec5822d6947af50ecebf9479b2b1dc10f49cf49161cee62283615eb75dcfe05e539bd80442799f67812d0d
SSDEEP 1536:Qo2sxEur907B9eyfpOMrzXkL5MVka2WyCVMzh:QohxEur907BfgM0OBPyPh
TLSH
T1A84384243AFB401DF2B3AF794BE475D6CA6FFA637A0BA45D1041034A4A23E41DD9163E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com [email protected] Payment informationAmount: 0.0990 BTC Bitcoin Address: 0xcb7dbbe31fbc053ca0b519aa0f0a2d63d6367322

Emails

[email protected]

Targets

- Target
  2026-07-17_a2270ead2e06964c74d3edae58f2472a_destroyer_elex_glassworm_wannacry
- Size 56KB
- SHA256 cdae656cb548e98170535717b32ccbf04cab31ca9de9882cc5d6262744175562
- MD5 a2270ead2e06964c74d3edae58f2472a
- SHA1 fbfbcf61a954872f8090b3a979201c3522b39cb7
- SHA512 44555896dbf41c74952d3f7721a3e94b9fa0a7d1c4ec5822d6947af50ecebf9479b2b1dc10f49cf49161cee62283615eb75dcfe05e539bd80442799f67812d0d
- SSDEEP 1536:Qo2sxEur907B9eyfpOMrzXkL5MVka2WyCVMzh:QohxEur907BfgM0OBPyPh
- TLSH
  T1A84384243AFB401DF2B3AF794BE475D6CA6FFA637A0BA45D1041034A4A23E41DD9163E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (378) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2