S0220 - Chaos

Chaos is Linux malware that compromises systems by brute force attacks against SSH services. Once installed, it provides a reverse shell to its controllers, triggered by unsolicited packets.

Author
agomez
Created
2023-08-14 15:43:59
Last updated
2026-02-07 19:01:26
Downloads
340869
IPv4 indicators
12
Hostname indicators
22
URL indicators
22
Sample indicators
340

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

https://github.com/Hacker2425/Ransomware-Builder URL

modified 2026-10-17 06:38:11
Chaos (Triage)

uploadfiler.com Hostname

modified 2026-10-17 06:31:45
Chaos (Maltiverse Threat Observatory)

a890040d3b56ed1b3a9ec6fe9db378d97b5fefa67e96b8d49ca2ff616e95a2a1 Sample

modified 2026-10-17 05:01:39
Chaos (Cyber Threat Alliance)

chaosyau.earlybird.rocks Hostname

modified 2026-10-17 04:37:31
Chaos (ThreatFox Abuse.ch)

mail.chaoserp.eu Hostname

modified 2026-10-17 04:36:40
Chaos (ThreatFox Abuse.ch)

www.tsrust.com Hostname

modified 2026-10-16 20:35:16
Chaos (ThreatFox Abuse.ch)

www.sxrust.com Hostname

modified 2026-10-16 20:35:15
Chaos (ThreatFox Abuse.ch)

https://dosya.co/yt4lyvdjhgyb/RORANSOMWARE.zip.html URL

modified 2026-10-16 18:33:02
Chaos (Triage)

cpcontacts.chaoserp.eu Hostname

modified 2026-10-16 16:38:02
Chaos (ThreatFox Abuse.ch)

dyuri.horak.hu Hostname

modified 2026-10-16 16:37:55
Chaos (ThreatFox Abuse.ch)

petrveprek.eu Hostname

modified 2026-10-16 16:34:10
Chaos (ThreatFox Abuse.ch)

https://www.mediafire.com/folder/05tuzyl2dyhhu/NexusMods URL

modified 2026-10-16 15:59:56
Chaos (Triage)

chaos.build Hostname

modified 2026-10-16 12:40:09
Chaos (ThreatFox Abuse.ch)

www.chaoslabel.com Hostname

modified 2026-10-16 12:37:13
Chaos (ThreatFox Abuse.ch)

45.153.127.224 IPv4

modified 2026-10-16 11:26:10
Chaos (ThreatFox Abuse.ch) · VPN (IPWhois.io)

accounts.corona-renderer.com Hostname

modified 2026-10-16 08:38:26
Chaos (ThreatFox Abuse.ch)

chaosparfums.com Hostname

modified 2026-10-16 08:37:02
Chaos (ThreatFox Abuse.ch)

chaos.health.blog Hostname

modified 2026-10-16 04:41:27
Chaos (ThreatFox Abuse.ch)

vraydr.arkinfo.in Hostname

modified 2026-10-16 04:40:25
Chaos (ThreatFox Abuse.ch)

mewo.chaoserp.eu Hostname

modified 2026-10-16 04:39:19
Chaos (ThreatFox Abuse.ch)

svchost.exe Sample

modified 2026-10-15 02:58:06
Chaos (Abuse.ch) · Generic.Malware (Abuse.ch)

2026-08-21_ba23c4ff6f347bd8dfa53d8c50d66cc3_destroyer_elex_glassworm_wannacry Sample

modified 2026-10-15 01:59:28
Chaos (Triage)

45.56.76.53 IPv4

modified 2026-10-14 21:25:06
Chaos (ThreatFox Abuse.ch)

Win32.Ransomware.Chaos.e.7z Sample

modified 2026-10-14 01:17:03
Chaos (Triage)

2026-10-13_5dd4abffa4383247b4853bd58b221f78_destroyer_elex_glassworm_wannacry Sample

modified 2026-10-13 12:39:52
Chaos (Triage)

50.116.24.242 IPv4

modified 2026-10-13 10:25:06
Chaos (ThreatFox Abuse.ch) · VPN (IPWhois.io)

Covid29 Ransomware.zip Sample

modified 2026-10-13 04:22:51
Chaos (Triage)

2024-09-08_6b573d2e5879c3cb307b1e1fdb9087f4_wannacry Sample

modified 2026-10-13 03:42:39
Chaos (Triage)

asd.exe Sample

modified 2026-10-13 02:01:47
Generic Malware (Hybrid-Analysis) · Chaos (Triage)

amd Sample

modified 2026-10-12 16:21:06
Chaos (MalwareBazaar Abuse.ch) · Chaos (ThreatFox Abuse.ch)

2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry Sample

modified 2026-10-12 16:19:50
Chaos (Triage)

2026-10-11_cac7539b653953e2bd3a4302fe31f322_elex_glassworm_wannacry Sample

modified 2026-10-12 10:29:01
Chaos (Triage)

2026-08-21_334b38df16bbd2d0c5bdbc2b0de4b52e_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-10-12 04:46:40
Chaos (Triage)

jaffacakes118_samples.part033.rar Sample

modified 2026-10-11 17:45:55
Chaos (Triage)

jaffacakes118_samples.part012.rar Sample

modified 2026-10-11 17:27:38
Chaos (Triage)

jaffacakes118_samples.part008.rar Sample

modified 2026-10-11 17:25:09
Chaos (Triage)

172.234.64.108 IPv4

modified 2026-10-11 17:25:05
Chaos (ThreatFox Abuse.ch)

45.79.221.250 IPv4

modified 2026-10-11 17:25:05
Chaos (ThreatFox Abuse.ch)

Triage.zip Sample

modified 2026-10-10 22:46:04
Chaos (Triage)

12e3e2892fe31aab9eec0986e106cf2c0ad1fa9fe162dcd2cd7eb1ef3327e96c.zip Sample

modified 2026-10-10 21:21:37
Chaos (Triage)

ErmWhatsWrongWithMyPC.exe Sample

modified 2026-10-10 21:10:07
Generic Malware (Hybrid-Analysis) · Chaos (Triage) · XWorm (MalwareBazaar Abuse.ch) · Ades_stealer (Triage)

f68bb733ccf311bd72c18205d04c113ddafbf9c8cc308f9fe831ca413efea03b Sample

modified 2026-10-10 16:05:36
Chaos (Cyber Threat Alliance)

DiscordExploit.exe Sample

modified 2026-10-10 14:10:43
Chaos (Triage)

2.26.99.48 IPv4

modified 2026-10-10 10:25:06
Chaos (ThreatFox Abuse.ch)

vx-underground.org Hostname

modified 2026-10-09 20:11:06
Lockbit (Triage) · Redline (Triage) · Malicious URL (Triage) · Asyncrat (Triage) · Dharma (Triage)

2026-10-07_b0fc0692660424064926a40a8e255d14_elex_glassworm_wannacry Sample

modified 2026-10-08 07:16:11
Chaos (Triage)

sub_cbe100c6df23.bin Sample

modified 2026-10-07 18:53:03
Chaos (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis) · Blackmatter (Triage)

130.110.5.114 IPv4

modified 2026-10-06 10:25:05
Chaos (ThreatFox Abuse.ch)

cone.exe.zip Sample

modified 2026-10-05 17:57:31
Destiny_stealer (Triage) · Valleyrat_s2 (Triage) · Xorist (Triage) · Discordrat (Triage) · Masslogger (Triage)

2026-10-04_8f2d89f8e22d59c21ebf945fb8785e49_destroyer_elex_glassworm_wannacry Sample

modified 2026-10-05 08:55:25
Chaos (Triage)

howtogetfreefortnite2022guidephoto.exe Sample

modified 2026-10-05 00:47:47
Generic Malware (Hybrid-Analysis) · Chaos (Triage)

Xeno1.3.60 Sample

modified 2026-10-03 08:47:02
Chaos (Triage)

869c14299d4b52a3f5b28ee46d5ccb295808f2c0bdd73bd3027689b0378baef4.zip Sample

modified 2026-09-30 22:20:09
Chaos (Triage)

36.94.34.18 IPv4

modified 2026-09-30 20:25:06
Chaos (ThreatFox Abuse.ch)

51.20.9.206 IPv4

modified 2026-09-30 20:25:06
Chaos (ThreatFox Abuse.ch)

2026-09-29_6e0f8c9db350131136b36a938ad3515c_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-30 19:40:05
Chaos (Triage)

AP Biology - Macromolecules.pptx Sample

modified 2026-09-30 16:41:55
Chaos (Triage)

https://github.com/Zusyaku/Malware-Collection/blob/main/No%20Escape.exe?ysclid=mukcb7q1b1657212466 URL

modified 2026-09-27 22:58:41
Chaos (Triage) · Suspicious URL (Triage)

185.196.8.218 IPv4

modified 2026-09-27 14:02:28
Chaos (ThreatFox Abuse.ch) · IMAP Attacker (Blocklist.de) · Mail Spammer (Blocklist.de) · Brute force attack on the SMTP service of the server S18 (Blocklist.net.ua) · FTP Attacker (Blocklist.de)

2026-09-26_17428ac927ce837c713cadbf685b2ed8_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-27 03:15:19
Chaos (Triage)

2026-09-25_5f682a8509eac6e507b56f84f6c42c20_elex_glassworm_wannacry Sample

modified 2026-09-26 01:44:10
Chaos (Triage)

2026-09-24_a8889bdcd8d3a436156d7a852cb72877_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-25 02:25:28
Chaos (Triage)

satoshi miner.exe Sample

modified 2026-09-24 20:56:51
Chaos (Triage) · Chaos (MalwareBazaar Abuse.ch)

burmaldaa.exe Sample

modified 2026-09-24 20:15:03
Chaos (Triage) · Chaos (MalwareBazaar Abuse.ch)

Win32.Ransomware.SkynetLocker.7z Sample

modified 2026-09-22 07:15:25
Chaos (Triage)

2026-09-21_0db6b3677589320c707507f1de3bfbb1_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-22 04:20:47
Chaos (Triage)

Yashma ransomware builder v1.2.exe Sample

modified 2026-09-19 13:55:44
Yashma (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis) · Chaos (Triage)

LithiumWareV2.exe.infected Sample

modified 2026-09-19 00:17:07
Chaos (Triage)

2026-09-18_421fffedce66b242a239f86a3f9d524f_elex_glassworm_wannacry Sample

modified 2026-09-18 10:19:11
Chaos (Triage)

2026-09-18_d8a58fb7bbf0074745e120c5a5d9b9ef_elex_glassworm_wannacry Sample

modified 2026-09-18 07:39:30
Chaos (Triage)

34.79.229.30 IPv4

modified 2026-09-18 05:27:35
Chaos (ThreatFox Abuse.ch) · Unknown malware (ThreatFox Abuse.ch) · Bruteforce (AbuseIPDB) · SSH Attacker (AbuseIPDB) · Port Scanner (AbuseIPDB)

31.56.209.245 IPv4

modified 2026-09-18 05:26:49
Chaos (ThreatFox Abuse.ch)

2026-09-16_ff4e9c63bf09f6eff41f43a4e9e90bd4_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 15:00:43
Chaos (Triage)

2026-09-16_660198996169613edc64e79630795221_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 12:05:31
Chaos (Triage)

2026-04-03_3252368c58ecead6e61d64cc9e96dbcf_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 02:25:06
Chaos (Triage)

2026-07-16_d55146f378b815e31aa505933214d4aa_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 02:10:32
Chaos (Triage)

2026-09-16_5e3ace858111cfe60cf83054f302fe8d_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 01:48:13
Chaos (Triage)

2026-09-16_901f9d5f5fbdde7ed442b3a8aeb13ebf_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 01:45:57
Chaos (Triage)

2026-09-16_afd3492716211bb11cd8d82211dadbd3_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 01:44:10
Chaos (Triage)

2026-09-16_c792054df2f455733fe20828e6fc3580_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 01:43:03
Chaos (Triage)

2026-09-16_ca3f6da84821c5fba61c7ba8a14f12a1_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-16 01:42:31
Chaos (Triage)

2026-09-15_22fe172d6ea78cf2c32bcac457c2301c_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-15 19:33:54
Chaos (Triage)

jaffacakes118_Some cracks and nifty things.zip Sample

modified 2026-09-15 02:49:25
Chaos (Triage)

TrojanRansomCovid29.exe Sample

modified 2026-09-13 13:10:31
Chaos (Triage)

INFECTED.rar Sample

modified 2026-09-12 00:35:20
Chaos (Triage)

2026-09-09_83906fda255285aafe9ce3654db988af_elex_glassworm_wannacry Sample

modified 2026-09-09 16:41:59
Chaos (Triage)

Yashma ransomware builder v1.2.exe Sample

modified 2026-09-08 22:55:05
Chaos (Triage)

2026-09-08_001a90b78ad0860e5986afd401f7a5f2_elex_glassworm_wannacry Sample

modified 2026-09-08 20:17:36
Chaos (Triage)

af0e24781ed3683f04dd86a616e31490f36c2da4cbb4fddc76efbd0fc4f15d55 Sample

modified 2026-09-07 09:45:04
Chaos (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

2026-09-03_6d0cfbfd5bbff364be6563ab4a2ff310_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-04 07:28:10
Chaos (Triage)

2026-09-03_ad808568d0beea99bad94bb0ebf1ded9_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-09-04 02:01:43
Chaos (Triage)

svchost.exe.bin Sample

modified 2026-09-04 00:14:22
Generic Malware (Hybrid-Analysis) · Chaos (Triage)

87501bb9f50174d8d306bbbbebe12903ff01d75de0cc32714ed82991b57a86c6 Sample

modified 2026-09-03 01:45:06
Chaos (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.zip Sample

modified 2026-09-02 17:16:35
Chaos (Triage)

cc4447c5ec011969daf63f49a1c9a4616ae6ce2f13febbab90da4269d9cb4d60 Sample

modified 2026-08-30 14:55:49
Chaos (Triage)

https://s3.us-east-005.backblazeb2.com/vx-underground-main/Builders/Zer0Day2Rat/Zer0Day2%20Rat%201.8.7z?X-Amz-Algorit... URL

modified 2026-08-30 03:57:19
Chaos (Triage)

gta6 installer.exe.zip Sample

modified 2026-08-29 00:46:03
Chaos (Triage)

www.chaosstore.tw Hostname

modified 2026-08-28 23:58:09
Chaos (ThreatFox Abuse.ch)

2026-08-25_6db1fe73bc878d9562ed0b9fb3b6eaac_elex_glassworm_wannacry Sample

modified 2026-08-26 22:12:30
Chaos (Triage)

2026-08-24_157982bfee7814c3f97550d569056c2d_chaos_destroyer_elex_glassworm_wannacry Sample

modified 2026-08-25 18:32:44
Chaos (Triage)