chaos | 44c72781ace7db466106bb829afbad99fe03ac00b3c8d22e8ef3419e6dcec679

General

Target
2026-09-05_7c2480ec00eab8362d98a3f6d02c0f6c_destroyer_elex_glassworm_wannacry
Size 89KB
Sample260907-thg5msyvav
SHA256 44c72781ace7db466106bb829afbad99fe03ac00b3c8d22e8ef3419e6dcec679
MD5 7c2480ec00eab8362d98a3f6d02c0f6c
SHA1 072b38be14596dfb99878aa8f3adfb6b0de94b26
SHA512 b28a96c7fc444761ca292c74e1b0ec381fce137fe7752ec054539783a0f4875b4a49ec0e90f1aaae058cdc6105706b2cceccab5c75e74cc117bde93c094fa727
SSDEEP 768:0qo2vNtcap5yquYr9knZeAz7pF/Fu9b4Ng7F:Do20QyzYr9kn4AP/Fu9b4Ng7F
TLSH
T16E936233267553D6D564CB3C89BEB00B0EBE7C0568169246E845BFC977E0E4588F2F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

Your computer was infected with a new virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $30 Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. MESSAGE ME: https://t.me/tyril2003 call me ALEXA BLISS Payment informationAmount: 0.00139 BTC Bitcoin Address: 1MCJ1EkfyaVyQmN49X3MPBCHmGLy1wvWDy

Wallets

1MCJ1EkfyaVyQmN49X3MPBCHmGLy1wvWDy

URLs

https://t.me/tyril2003

Targets

- Target
  2026-09-05_7c2480ec00eab8362d98a3f6d02c0f6c_destroyer_elex_glassworm_wannacry
- Size 89KB
- SHA256 44c72781ace7db466106bb829afbad99fe03ac00b3c8d22e8ef3419e6dcec679
- MD5 7c2480ec00eab8362d98a3f6d02c0f6c
- SHA1 072b38be14596dfb99878aa8f3adfb6b0de94b26
- SHA512 b28a96c7fc444761ca292c74e1b0ec381fce137fe7752ec054539783a0f4875b4a49ec0e90f1aaae058cdc6105706b2cceccab5c75e74cc117bde93c094fa727
- SSDEEP 768:0qo2vNtcap5yquYr9knZeAz7pF/Fu9b4Ng7F:Do20QyzYr9kn4AP/Fu9b4Ng7F
- TLSH
  T16E936233267553D6D564CB3C89BEB00B0EBE7C0568169246E845BFC977E0E4588F2F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

chaos persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Detects command variations typically used by ransomware
- Renames multiple (310) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2