chaos

General

Target

FridayBoycrazy123.exe
Size

279KB
Sample

240808-hl165s1bjn
MD5

8f34508c833a7f2d6bd306fbe5e90086
SHA1

d04dd0fca1c332112fa8261f55638e268ba941a9
SHA256

f3bfcddc0c2f5a2842ee4cf114783a3ab3c44cde03892ed71b31ec2564cd2041
SHA512

056b1ee68c9f9de9f5ec92d8a20fb01ba66d2cf2a61523ff492f6489c142dbcb81828f8b938a3f6dfb2dd2cc9b1ad245c495070b3a2250f410b81ca4381fb372
SSDEEP

6144:iFr9SiyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswI:CyJ7/+Wd1kRnFX4mNzxyeOswI

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Warning.txt

Ransom Note

Your files has been encrypted By FridayBoycrazy and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $100 Dollars can be made in Venmo Or Robux only Please Contact Us At Gmail: [email protected] Discord Username: fridayboycrazy Payment information Venmo Amount: $100 Robux Payment Information: 10,000 Paid Ransom: https://www.roblox.com/game-pass/887175972 Paid Ransom: https://venmo.com/u/gratefulcode

Emails

[email protected]

URLs

https://www.roblox.com/game-pass/887175972

https://venmo.com/u/gratefulcode

Targets

- Target
  
  FridayBoycrazy123.exe
- Size
  
  279KB
- MD5
  
  8f34508c833a7f2d6bd306fbe5e90086
- SHA1
  
  d04dd0fca1c332112fa8261f55638e268ba941a9
- SHA256
  
  f3bfcddc0c2f5a2842ee4cf114783a3ab3c44cde03892ed71b31ec2564cd2041
- SHA512
  
  056b1ee68c9f9de9f5ec92d8a20fb01ba66d2cf2a61523ff492f6489c142dbcb81828f8b938a3f6dfb2dd2cc9b1ad245c495070b3a2250f410b81ca4381fb372
- SSDEEP
  
  6144:iFr9SiyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswI:CyJ7/+Wd1kRnFX4mNzxyeOswI
Score

10^/10

chaos defense_evasion discovery evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1