Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware

Based on the provided information, here's a summary of the malware analysis and attack lifecycle:

Malware Analysis

ms_upd.exe (Downloader)

• Functionality: Acts as a downloader to retrieve additional payloads from a C2 server.
• Behavior:
  • Collects host information (computer name, username, domain).
  • Registers with the C2 server at moonzonet[.]com.
  • Receives instructions and downloads three components:
    • Game.dll (saved as WebView2Loader.dll)
    • Game.exe
    • Game.config (saved as visualwincomp.txt)
• Communication:
  • Sends periodic /check requests to the C2 server.
  • Reports status updates ("downloading", "running").
• Obfuscation: None; uses plaintext strings and statically resolved API imports.

Game.exe (Custom RAT)

• Functionality: A custom Remote Access Trojan that masquerades as a legitimate Microsoft WebView2 application.
• Behavior:
  • Trojans the official Microsoft WebView2APISample project.
  • Implements obfuscation and anti-analysis techniques.
• Obfuscation Techniques:
  • Dynamic API calls (T10

Read the full article at Rapid7 Blog

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.