chaos

General

Target

2024-04-21_daf8e1d1c3778042cc92374eeba5af51_chaos_destroyer_wannacry
Size

24KB
Sample

240421-2hba4acc53
MD5

daf8e1d1c3778042cc92374eeba5af51
SHA1

8b9f991cb7e290ef86eb0494c4ef7e14607240ee
SHA256

83ebe9ac38941dfecead0c664b3517032ce8258f240f67699a6424290871cdee
SHA512

cc744eb077f4e8b7089a0484d9a1662b509dfbedf94558a7bdded52112558f5bfd29fc32cbbd15d03a2ba360d10fc0c76762cf3fe8cf9c20006fddd0e6a1cbce
SSDEEP

384:s3Mg/bqo2i2jQZ/rtcp3pUNqaJ2Gr91CJaPTt6oRUeU:Sqo2CZTypGUe/r9SyhaeU

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

(HACKED BY IRIS) Hello! All of your files have been encrypted! Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $350. Payment can be made in Monero only. What happens if i don't pay? If you decide not to pay the ransom, All of your files and everything on your device will be released on the dark web for people to buy/view and will be deleted from your cumputer forever. This also goes for any other devices that are on your network (WIFI). How do I buy Monero/XMR? Look up a youtube video on how to buy the coin, or visit localmonero.co to buy from a seller. Payment Type: Monero/Xmr Coin Amount: $350 USD In Monero/XMR Monero/XMR address to send to: 48FHcV21wn56hRt2kipV4tScT4RnVU5PyUoAqjRQbdLqEvKDg3E4Kgfc1yb7RLqG7RXz8N4sxQgdmEgrRoR8AAyh5wW3Ui4 For any questions contact: [email protected]

Emails

[email protected]

Targets

- Target
  
  2024-04-21_daf8e1d1c3778042cc92374eeba5af51_chaos_destroyer_wannacry
- Size
  
  24KB
- MD5
  
  daf8e1d1c3778042cc92374eeba5af51
- SHA1
  
  8b9f991cb7e290ef86eb0494c4ef7e14607240ee
- SHA256
  
  83ebe9ac38941dfecead0c664b3517032ce8258f240f67699a6424290871cdee
- SHA512
  
  cc744eb077f4e8b7089a0484d9a1662b509dfbedf94558a7bdded52112558f5bfd29fc32cbbd15d03a2ba360d10fc0c76762cf3fe8cf9c20006fddd0e6a1cbce
- SSDEEP
  
  384:s3Mg/bqo2i2jQZ/rtcp3pUNqaJ2Gr91CJaPTt6oRUeU:Sqo2CZTypGUe/r9SyhaeU
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2