chaos | 6e0661f16986a912887a3c178fd1cf686caaa8b13c24b5575b88462009104e80

General

Target
Yashma Ransomware Builder.7z
Size 69KB
Sample260805-pyqdqsstg1
SHA256 6e0661f16986a912887a3c178fd1cf686caaa8b13c24b5575b88462009104e80
MD5 568210493bfb10165e2475512d1652a8
SHA1 cfe400e07073c6b72a5606a008c0e119cd2b4522
SHA512 d0e96229b91e11fc9901c8917e59ca9446d688ed3b04aa1a9cc4f7e0bbe213e1b05d6352cd1fc05f5b3ae08d86e84559a664da10fdb777e6b7a811bc5dbe77d7
SSDEEP 1536:dQ8XKj4GPahIwGB9fHxBJ6YIJPip5ES/R7W9mW+UcDzMoRcHn/1:S8bZGzzJX08ES/E9mW+UcDzMZHd
TLSH
T1AB630260E84EFF3BCBA151565E21B17C9BC3C679E29038068E18528DB237649BC275DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

Targets

- Target
  Yashma Ransomware Builder/Yashma ransomware builder v1.2.exe
- Size 538KB
- SHA256 f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
- MD5 13e878ed7e547523cffc5728f6ba4190
- SHA1 878ad3025f8ea6b61ad4521782035963b3675a52
- SHA512 a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
- SSDEEP 3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz
- TLSH
  T15DC47E002EF44A1ED32452B8D72BD83C8BF69D733526C2153AED5E8B7B67720861375A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2