chaos

General

Target

2024-09-07_888b8d186f13aeb525e7687271723a33_destroyer_wannacry
Size

24KB
Sample

240907-rrk7jszgnh
MD5

888b8d186f13aeb525e7687271723a33
SHA1

110322d8c40f5e867ade951ad4872eb507468fa8
SHA256

77fcbbfa7a2bd9d882272e571f356fbea374e0c662b4de444af8793708767a5e
SHA512

65addc33be49d7ff183da7715e57481a1ebb8a137016c800fbd53ca7060e7d1cd43519db2a67b8fc774491410c155ccd4f143f7a8defcf9e0370540aa914c86d
SSDEEP

384:23Mg/bqo2NJV9yEQpAgob9JGr91CsDog25eX:Eqo2vV9tQpsLGr9RDo7eX

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

All of your files have been stolen and encrypted, we have downloaded sensitive and compromising data from your system/network including your financial data and network map. Your files have been encrypted and you won't be able to decrypt them without our help. If you modify the files you won't be able to decrypt them What can I do to get my files back? The price for decription is $1k. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? if you don't know how to Purchase, since you're in south africa binance is the best. download the app and you'll see it's easy to buy bitcoin. You can try whatever you wanna try but don't modify the files, they'll be damaged and impossible to decrypt. it's nothing personal, it's all about money. have a great day. Payment information Amount: 1000 USD Use an email adress as payment reference/description to recieve the decryption key. Non payment will result in your data being published. YOU HAVE 7 DAYS, AFTER 3 DAYS THE MONEY DOUBLES. Bitcoin Address: bc1qpn32q8a3jykzpfnrv6crqulk7wguaryhxzadqa

Targets

- Target
  
  2024-09-07_888b8d186f13aeb525e7687271723a33_destroyer_wannacry
- Size
  
  24KB
- MD5
  
  888b8d186f13aeb525e7687271723a33
- SHA1
  
  110322d8c40f5e867ade951ad4872eb507468fa8
- SHA256
  
  77fcbbfa7a2bd9d882272e571f356fbea374e0c662b4de444af8793708767a5e
- SHA512
  
  65addc33be49d7ff183da7715e57481a1ebb8a137016c800fbd53ca7060e7d1cd43519db2a67b8fc774491410c155ccd4f143f7a8defcf9e0370540aa914c86d
- SSDEEP
  
  384:23Mg/bqo2NJV9yEQpAgob9JGr91CsDog25eX:Eqo2vV9tQpsLGr9RDo7eX
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2