b95174d92def49d29ef9236d2da896a493e14de4cf2a38622c81e64b37ab45c1

Sharing

Copy URL Twitter E-mail

General

Target
cff25c-chaosmod.zip
Size 10.6MB
Sample260801-ynx59sfl6y
SHA256 b95174d92def49d29ef9236d2da896a493e14de4cf2a38622c81e64b37ab45c1
MD5 870ab812a846266875c27d31d84062e1
SHA1 503f9bf5862abaf45311949a3681ab21200127f2
SHA512 a1f2aae29c53fe0d90639fa42ff9bc0c93eaf5da5d10f0589b1bdaef2ac01e9f071f047ae2d24d0df09d31e56005b7730bddcda9837a4a88e22447e96f906fa0
SSDEEP 196608:hsW5+iPlIE6ff11x2kZ+3NP+FEHrq1yTrvqFF2Kq0dbl+12LYc:hsynPF6n9qOEH/PvqFF2b0do1gV
TLSH
T1F4B6336257AFCE4DBA9CD7A684483716FC2946A0580E1FF71485B0BF16208FE85D8E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  cff25c-chaosmod.zip
- Size 10.6MB
- SHA256 b95174d92def49d29ef9236d2da896a493e14de4cf2a38622c81e64b37ab45c1
- MD5 870ab812a846266875c27d31d84062e1
- SHA1 503f9bf5862abaf45311949a3681ab21200127f2
- SHA512 a1f2aae29c53fe0d90639fa42ff9bc0c93eaf5da5d10f0589b1bdaef2ac01e9f071f047ae2d24d0df09d31e56005b7730bddcda9837a4a88e22447e96f906fa0
- SSDEEP 196608:hsW5+iPlIE6ff11x2kZ+3NP+FEHrq1yTrvqFF2Kq0dbl+12LYc:hsynPF6n9qOEH/PvqFF2b0do1gV
- TLSH
  T1F4B6336257AFCE4DBA9CD7A684483716FC2946A0580E1FF71485B0BF16208FE85D8E73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  ChaosMod.asi
- Size 2.6MB
- SHA256 2e5a59db61f009d3b274ced0bfc50ee8d6e553b4715ccfc3d021cd145fb4179b
- MD5 31ca21b432530ebd9b205304360252b4
- SHA1 6c09dffd09f7b3961573364e5b5f4dc820e46910
- SHA512 e141b57fb0fe618984b3ebada1d54cfad88bb6bd3a428f2054af7e482afa319df07056974a6ab1ca1f6034c73fa97de23091fba9fdd8376b4cb80867972c16ac
- SSDEEP 49152:PYJqB3n6GZwgsrDG8ZQMSS+uGb1FNJb0P94n6Z0w7ppgnWcXnVZq1ayXP3Hjmx:xd1UkTbZn697puW
- TLSH
  T1A3C57E27A76500ACD077C1B8CA6B5947E6F1304503706AEF1AE185666F7BBE01B7FB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ChaosModInstaller.exe
- Size 5.5MB
- SHA256 7b8fa64f27e26b7e61d17b28710d65650ae95049d1f37d5535b085495d3490a9
- MD5 de63efb491f274087fff827928c1a9cc
- SHA1 385a43a6403f3654054f0e21f2315192b6b28e0f
- SHA512 3b1f296aa25097d707dad23e5be2dc8e76d95b6d3c55b266ac4a3ac88fde63c6cc96455e3a60eef3185631ce56d895924ce06f497b86416fa8259e83471adf2c
- SSDEEP 98304:prJyftTGr5cuhnA8Q2/wszS1TzRGYc7OLuDcO1Z/5yqpPJZGgMEnYm:lJy9GBnAB2//z6fFSGO1Z/B4tEnYm
- TLSH
  T1DD461223F2CBE03EE05D5B3745A2A22494FBAB616426AD1786ECB49CCF350641D3E747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral5 behavioral6
- Target
  chaosmod/ChaosModVConfig.exe
- Size 3.8MB
- SHA256 827760bc8e434768a2074d8ab9a8b32a225bde206a25a8054d59b35644e08823
- MD5 70e681cab0aab5d79aa7d72d0edd07fc
- SHA1 bb4dd2795c35c89130b199755261efb49f4483e3
- SHA512 0765877cd1b36b83c03f5071ebcaa43a7f1503a725d9a4d9675420f7d7fd98d6b3496a08b40ea778c463c64ef8771095dcbea0daa0cb10f71e38a31914c10c3a
- SSDEEP 49152:jxWf7xWCOiOx9NpGdTWCqOpV4MKlyCCz6vH3vsIDIO/wUQjPW1n4f4jgxBBjHQtG:jxWTxWJ0T61gW1A9
- TLSH
  T1B9068D1173E8852AD56F0B7490724464ABB2BC4AE7E2D70F25947DDE3CB3B528E413A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral7 behavioral8
- Target
  chaosmod/TwitchChatVotingProxy.exe
- Size 8.4MB
- SHA256 8d847e2d57cea2d32fa5827956e8b321f7ac39f156fd52ef66f368a7ef3e4f3e
- MD5 8db627bd7fd82e61620f4dff09fab3b5
- SHA1 b2344b308c616d2f9d9ae7e5c92601afa9e437a7
- SHA512 2ae5e8661d3c09f864954ca8673de61bc9cadc1f2ab2775cb6ee6d19242bf666bd138b73b301ecd53a903af8a67c0e09c5339f74e1cd46bcda77b83df4e97387
- SSDEEP 49152:cpcH0KxAnTRIYttwGLCIC3G3Plj4jgxBBjHQtDWo7lhWYMc452gsCX/9EugcuYeP:xSnFhtnYWtOKT3sCX/9EZc1S
- TLSH
  T1EB965A0963E8AA3BE5EF5B36A032412167B2EDC6E352E34F254CF5E82D467849D00777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  chaosmod/twitchOverlay/bundle.js
- Size 33KB
- SHA256 a60b06e903b99a7a846723162a4b49acecb078baa9ba61c85338134cb707038f
- MD5 c51fc26929bf38a488fb88233f2db467
- SHA1 a8c4acdfc584c8621bf69ee894d1cf4222ec1243
- SHA512 9cdf2cef69548ecb797db5f2e4da7d5b2183f776c6446642079576034b58dac83db3411b6aed0906dcd2028755aaa5f24a1b9a1dd0bc661ee916c6e938e1a35d
- SSDEEP 768:kv4sAbxakl6T5I2cFyKR9vXmv+XMo+MVaWG4dcOyQpdw80sdmkAduFe73vhNrVld:kAsAYkl6T5Intmv+PaWGhX+w80sdmkMh
- TLSH
  T112E21A5EEF04163087FA56A772DA326B9301748298B3599C944FFCE64468C981F3CEBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  chaosmod/twitchOverlay/index.html
- Size 398B
- SHA256 ac9057f68994b56e7196999c37cb997b5df863a72edce2c6687b1d758cb510f6
- MD5 ed66c0959cd9186a2f5004324fc22639
- SHA1 6394b8980343f6cc3d1ffa1f4db9ca4c8d46386f
- SHA512 62a6183f553953aa66704f5579400c810493514318c3de32b6b9b36f2e44e41a77bbcdd1acf2d3d8ff6ce9d4d56d59a14dacb474b374eb67a883b853d39bc805
- TLSH
  T1EDE0688A7854EA8912B0462B55B3F19C8A97DE4973A0BC22B9C6123B2BC7718CC4B056
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14