chaos

General

Target

2024-07-25_995bb40bd1e676972428beb4a9cf7f96_wannacry
Size

924KB
Sample

240725-jee6rswdjq
MD5

995bb40bd1e676972428beb4a9cf7f96
SHA1

49ee1caa2fdeaf62ed60f61765f0bf3ac4ef040d
SHA256

fdfafaefbc9aa35dea9698a3f95b7c78977c0e3e5ab24e1728cd01f276a8c666
SHA512

30b57dda8b472810e2765634b444a792658e95ddd03d7ca33cd3776a3187787cb321d71f7114a0cd803ead5d8d85ef114b147a632aea613a438f3a0ee25ec579
SSDEEP

12288:B0u0frNC1YM8A/hZA4C81uCpGotomst1MAvDHeDW4Xyyvms6DKtVog/aLYkTIAt2:BuTwNmEaEZ

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\OceanCorp.txt

Ransom Note

----> OceanSpy Ransomware, Game Project from OceanCorp Team <---- All of your files have been encrypted and you won't be able to decrypt / Restore them without our help How To Restore Files? You need to buy our special decryption key with Bitcoin to decrypt all your system! How To Get Bitcoin? This is different beetween countries, you can make google search to look what's the available platforms at your country. Many of our customers have reported these sites to be fast and reliable: OKX - https://www.okx.com Coinmama - https://www.coinmama.com Bitpanda - htps://www.bitpanda.com Want to be sure before you pay we can decrypt your files? You can contact us on telegram and send us 1 file, and we will decrypt it for you. Telegram: [ @OceanCorpBot ] Payment information Amount: 0.015 BTC Bitcoin Address: bc1qu34mwa42deh3zl359q3l2wrvh2g5fgwj7vz4re After you pay, please contact us on telegram [ @OceanCorpBot ] and send us the Transaction ID to get your Decryption key. Kind Regards dwShark

URLs

https://www.okx.com

https://www.coinmama.com

Targets

- Target
  
  2024-07-25_995bb40bd1e676972428beb4a9cf7f96_wannacry
- Size
  
  924KB
- MD5
  
  995bb40bd1e676972428beb4a9cf7f96
- SHA1
  
  49ee1caa2fdeaf62ed60f61765f0bf3ac4ef040d
- SHA256
  
  fdfafaefbc9aa35dea9698a3f95b7c78977c0e3e5ab24e1728cd01f276a8c666
- SHA512
  
  30b57dda8b472810e2765634b444a792658e95ddd03d7ca33cd3776a3187787cb321d71f7114a0cd803ead5d8d85ef114b147a632aea613a438f3a0ee25ec579
- SSDEEP
  
  12288:B0u0frNC1YM8A/hZA4C81uCpGotomst1MAvDHeDW4Xyyvms6DKtVog/aLYkTIAt2:BuTwNmEaEZ
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2