a2254802dd387d0e0ceb61e2849a44b51879f625b89879e29592c80da9d479a2.exe

Classification: Malicious

a2254802dd387d0e0ceb61e2849a44b51879f625b89879e29592c80da9d479a2.exe is a malicious file sample. Linked to Ryuk, Chaos malware.

Detection summary

  • 50 antivirus detections
  • 0 IDS alerts
  • 50 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: RYUK (S0446) CHAOS (S0220)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-08-27 10:09:40 2026-08-27 10:09:40 malicious-activity
Chaos Triage 2026-02-14 02:02:00 2026-05-01 17:43:40 malicious-activity S0220 Chaos
Ryuk ThreatFox Abuse.ch 2025-08-28 21:29:31 2025-08-28 21:29:31 S0446 Ryuk
Generic Malware Hybrid-Analysis 2025-08-28 19:22:13 2025-08-28 20:22:32

Tags

evasive ransomware windows-server-utility win.ryuk chaos defense_evasion evasion execution impact linux persistence spyware stealer

Sample information

Filenames
a2254802dd387d0e0ceb61e2849a44b51879f625b89879e29592c80da9d479a2.exe, Chaos.exe, GOATEDSIGMA.exe
File type
PE32 executable for MS Windows 4.00 (GUI), Intel i ...
Size
269312 bytes
MD5
97517b7480182b69b42dc58d2c61f7e0
SHA-1
ab94da5e3094ce259171bc3db43a234ad8c05b28
SHA-256
a2254802dd387d0e0ceb61e2849a44b51879f625b89879e29592c80da9d479a2
SHA-512
70c8ff95a0e58d17a42c33f5ffdacdb4e50864ade46bba65a8c6d67f5582fedf29772ac632bc481039f427de970442c38eac0d000453470e6ca4c60518d806a6
First indexed
2025-08-28 19:11:01
Last updated
2026-05-01 17:56:00

Antivirus detections

EngineDetection
APEXMalicious
AVGWin32:MalwareX-gen [Ransom]
AhnLab-V3Ransomware/Win.FTD.C4580180
Antiy-AVLTrojan[Ransom]/Win32.Dcrypt.a
ArcabitTrojan.Ransom.Imps.3
AvastWin32:MalwareX-gen [Ransom]
AviraHEUR/AGEN.1370958
BitDefenderGen:Heur.Ransom.Imps.3
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.MsilFC.S23210427
CTXexe.ransomware.imps
ClamAVWin.Ransomware.Hydracrypt-9878672-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.EncoderNET.45
ESET-NOD32a variant of MSIL/Filecoder.Chaos.A
Elasticmalicious (high confidence)
EmsisoftGen:Heur.Ransom.Imps.3 (B)
F-SecureHeuristic.HEUR/AGEN.1370958
FortinetMSIL/Filecoder.AGP!tr.ransom
GDataMSIL.Trojan-Ransom.Remind.B
GoogleDetected
IkarusTrojan.Filecrypter.Chaos
K7AntiVirusRansomware ( 005a8b921 )
K7GWRansomware ( 005a8b921 )
KasperskyHEUR:Trojan-Ransom.MSIL.Agent.gen
Kingsoftmalware.kb.c.1000
MalwarebytesGeneric.Malware.AI.DDS
MaxSecureTrojan.Malware.300983.susgen
McAfeeDReal Protect-LS!97517B748018
MicroWorld-eScanGen:Heur.Ransom.Imps.3
MicrosoftRansom:MSIL/FileCoder.AD!MTB
RisingRansom.Destructor!1.B060 (CLASSIC)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.dt
SophosTroj/Ransom-GWT
SymantecRansom.Sorry
TencentTrojan-Ransom.Msil.Agent.ga
Trapminemalicious.moderate.ml.score
TrellixENSGenericRXPW-PH!97517B748018
TrendMicroTrojanSpy.MSIL.CHAOS.SMPI
TrendMicro-HouseCallTrojanSpy.MSIL.CHAOS.SMPI
VBA32Trojan.MSIL.DelShad.Heur
VIPREGen:Heur.Ransom.Imps.3
VaristW32/A-17b8a5e1!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
ZoneAlarmTroj/Ransom-GWT
huorongRansom/LockFile.fe

Process list

NameCommand line
GOATEDSIGMA.exe
svchost.exe
cmd.exe/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
vssadmin.exevssadmin delete shadows /all /quiet
WMIC.exewmic shadowcopy delete
cmd.exe/C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exebcdedit /set {default} recoveryenabled no
cmd.exe/C wbadmin delete catalog -quiet
wbadmin.exewbadmin delete catalog -quiet
rundll32.exe%WINDIR%\system32\shell32.dll,OpenAs_RunDLL %APPDATA%\GOATEDSIGMA
AcroRd32.exe"%APPDATA%\GOATEDSIGMA"
RdrCEF.exe--backgroundcolor=16448250
RdrCEF.exe--type=renderer --primordial-pipe-token=00BB7436B50589E9C99D17D6EF3FD2FB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=00BB7436B50589E9C99D17D6EF3FD2FB --renderer-client-id=2 --mojo-platform-channel-handle=1300 --allow-no-sandbox-job /prefetch:1
RdrCEF.exe--backgroundcolor=16448250
AcroRd32.exe"%APPDATA%\GOATEDSIGMA"
GOATEDSIGMA.exe
svchost.exe
cmd.exe/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
vssadmin.exevssadmin delete shadows /all /quiet
WMIC.exewmic shadowcopy delete
cmd.exe/C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exebcdedit /set {default} recoveryenabled no
cmd.exe/C wbadmin delete catalog -quiet
wbadmin.exewbadmin delete catalog -quiet
WindowsPackageManagerServer.exe-Embedding
svchost.exe
cmd.exe/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
vssadmin.exevssadmin delete shadows /all /quiet