chaos | d7805e377e19ede9fe23cae847b2e18f2a09608687add37768ec4f7ba67acda7

General

Target
2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry
Size 28KB
Sample260806-k2faqaxerf
SHA256 d7805e377e19ede9fe23cae847b2e18f2a09608687add37768ec4f7ba67acda7
MD5 7e1ebea00ee57caf1838c87f9009bd03
SHA1 5e5da3af1007a6efeabb1fff952b7e487c2ea677
SHA512 4395aa6aac36484bba8e81138f1bd612c51bb7b45f065ea50176664be5de23533a4c158241289dbd6669c9240f76e80af2ba80a2236c360657d3c587112a6889
SSDEEP 384:DtWZPzzxAm1v75rhfdPxpjCG3N/ySqlZOy5o91zg9SKykg82vn:67zxAmr1lPuG30jho9S9ny382/
TLSH
T1F6D2A44477FA9A36FABF5F3869B254014B76B916DC2DD74E088D41890C32B8C8DA0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can recover all your files! All your files, including documents, photos, databases, and other important data, have been encrypted. What guarantees do we provide? You can send up to 3 of your encrypted files, and we will decrypt them for free. You must follow these steps to decrypt your files: 1. Contact us via our OnionMail: [email protected] (If you do not receive a response within 24 hours, check your spam folder). 2. Obtain Bitcoin: You will need to pay $500 USD in Bitcoins for the decryption. After payment is confirmed, we will send you the tool to decrypt all your files. Bitcoin Wallet Address: bc1q3vp3m5dnleszjcwhnzs5gxmcnfx9dfkl8fcny4

Emails

[email protected]

Targets

- Target
  2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry
- Size 28KB
- SHA256 d7805e377e19ede9fe23cae847b2e18f2a09608687add37768ec4f7ba67acda7
- MD5 7e1ebea00ee57caf1838c87f9009bd03
- SHA1 5e5da3af1007a6efeabb1fff952b7e487c2ea677
- SHA512 4395aa6aac36484bba8e81138f1bd612c51bb7b45f065ea50176664be5de23533a4c158241289dbd6669c9240f76e80af2ba80a2236c360657d3c587112a6889
- SSDEEP 384:DtWZPzzxAm1v75rhfdPxpjCG3N/ySqlZOy5o91zg9SKykg82vn:67zxAmr1lPuG30jho9S9ny382/
- TLSH
  T1F6D2A44477FA9A36FABF5F3869B254014B76B916DC2DD74E088D41890C32B8C8DA0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution chaos impact persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2