chaos

General

Target

2024-03-24_ee42b46e17aea48b2b2863870d550152_chaos_destroyer_wannacry
Size

31KB
Sample

240324-yc7wbsff28
MD5

ee42b46e17aea48b2b2863870d550152
SHA1

bc55e9feb8f4eb627e2848e0a3e350b176e70a48
SHA256

af7f876a423f8223a333aaf0d59cbc4dce7ee93ae431a25f97ea5479cfbd2b2c
SHA512

ed27eaf5f8a9dc547ebb74c06bd028bb2f0f0ed18de60e75a608487c3c17d197e6f73f0f9fede6f05b2224a38acd7707984e77fcf5bfc5251f0eff2bf9064902
SSDEEP

768:7qo25O5p1r2sSiVM2r9JFkiUeCDY9Ogare:Wo2ErhVM2r93rCDwOLr

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\README.txt

Ransom Note

All of your files have been encrypted. Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software. This software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is $100. Payment can be made in Bitcoin (Bitcoin Address: bc1qakhl8eu20ely220fxm6d3tjsk2al64vrha4sxa), Ethereum (ETH Address: 0x22D2C1C38b3c26C9E403B34ea5aF42Af00e90d9f), Binance Coin (BNB Address: bnb17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV0205gfc6ykk), or through PayPal (Burner Account: [email protected]). You can make the payment directly by visiting this PayPal site: PayPal Payment Site. How do I pay, where do I get Bitcoin, Ethereum, Binance Coin, or PayPal? Purchasing Bitcoin, Ethereum, or Binance Coin varies from country to country, you are best advised to do a quick Google search yourself to find out how to buy Bitcoin, Ethereum, Binance Coin, or set up a PayPal account. These sites will help you to get fast and reliable Bitcoin, Ethereum, Binance Coin, or PayPal. Coinmama - https://www.coinmama.com/ Bitpanda - https://www.bitpanda.com/ If you will try to seek for help or advice we recommend not to. Why you ask? Because no other software can decrypt this ransomware, only us have the special key to unlock it. So getting other decrypters will be worthless. Don't even think about calling the cops; we will snitch about your pedo activity! You have exactly 12 hours from now to pay up or your PC will be locked for a very long time, approximately 125 Years! Have fun buddy. We monitor every move you make, 👁️‍🗨️ with 8 eyes on you, always one step ahead 👁️, lurking in your devices.

Emails

[email protected]

URLs

https://www.coinmama.com/

https://www.bitpanda.com/

Targets

- Target
  
  2024-03-24_ee42b46e17aea48b2b2863870d550152_chaos_destroyer_wannacry
- Size
  
  31KB
- MD5
  
  ee42b46e17aea48b2b2863870d550152
- SHA1
  
  bc55e9feb8f4eb627e2848e0a3e350b176e70a48
- SHA256
  
  af7f876a423f8223a333aaf0d59cbc4dce7ee93ae431a25f97ea5479cfbd2b2c
- SHA512
  
  ed27eaf5f8a9dc547ebb74c06bd028bb2f0f0ed18de60e75a608487c3c17d197e6f73f0f9fede6f05b2224a38acd7707984e77fcf5bfc5251f0eff2bf9064902
- SSDEEP
  
  768:7qo25O5p1r2sSiVM2r9JFkiUeCDY9Ogare:Wo2ErhVM2r93rCDwOLr
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2