chaos | 5585f8ad5b47d819991152ff4312d357bac1f8046c5477f3a0cb5715d107b553

General

Target
2026-08-05_8085bf42c48ace6974db9ea373dcc634_destroyer_elex_glassworm_wannacry
Size 28KB
Sample260806-ae724sal3v
SHA256 5585f8ad5b47d819991152ff4312d357bac1f8046c5477f3a0cb5715d107b553
MD5 8085bf42c48ace6974db9ea373dcc634
SHA1 09495804dc2899ee2a9580a80f6168a9a74963a3
SHA512 b3855592704ee602ae5698ad74be99194107d082a725770ff02f48eacdb446a8a7854ae57137aa18c4005d631e29d8912ea004e2a17f43eb0ec2d6bafe6d4e5f
SSDEEP 384:ytWZPzzxAm1v75rhfdPxpjCG3N/yjqloOy5o91zg9SKykB82v4:X7zxAmr1lPuG30bho9S9nyO82Q
TLSH
T178D2A44477FA9A36FABF5F3869B254014B76B912DC29D74E088D41890C32B8C8DA0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note

Don't worry, you can recover all your files! All your files, including documents, photos, databases, and other important data, have been encrypted. What guarantees do we provide? You can send up to 3 of your encrypted files, and we will decrypt them for free. You must follow these steps to decrypt your files: 1. Contact us via our OnionMail: [email protected] (If you do not receive a response within 24 hours, check your spam folder). 2. Obtain Bitcoin: You will need to pay $500 USD in Bitcoins for the decryption. After payment is confirmed, we will send you the tool to decrypt all your files. Bitcoin Wallet Address: bc1q3vp3m5dnleszjcwhnzs5gxmcnfx9dfkl8fcny4

Emails

[email protected]

Targets

- Target
  2026-08-05_8085bf42c48ace6974db9ea373dcc634_destroyer_elex_glassworm_wannacry
- Size 28KB
- SHA256 5585f8ad5b47d819991152ff4312d357bac1f8046c5477f3a0cb5715d107b553
- MD5 8085bf42c48ace6974db9ea373dcc634
- SHA1 09495804dc2899ee2a9580a80f6168a9a74963a3
- SHA512 b3855592704ee602ae5698ad74be99194107d082a725770ff02f48eacdb446a8a7854ae57137aa18c4005d631e29d8912ea004e2a17f43eb0ec2d6bafe6d4e5f
- SSDEEP 384:ytWZPzzxAm1v75rhfdPxpjCG3N/yjqloOy5o91zg9SKykB82v4:X7zxAmr1lPuG30bho9S9nyO82Q
- TLSH
  T178D2A44477FA9A36FABF5F3869B254014B76B912DC29D74E088D41890C32B8C8DA0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2