chaos

General

Target

2024-09-09_f7171e2e587d97fc079d0afb7ec73634_destroyer_wannacry
Size

24KB
Sample

240909-ngdsyavdrn
MD5

f7171e2e587d97fc079d0afb7ec73634
SHA1

54fe4810af4babdec3efc2fa7ae3f9c7117be435
SHA256

bfe508310190495d66f666bc9c65ac4d344a83fa8bb9291563090614aa22a7e5
SHA512

596c553dd2cab33443ba6ab90004e2593cd10c04f3548af6c99297947114a4312858f67ce3aef5474de0f01b08df9745893b4d7480308f148a397a50047efcaf
SSDEEP

384:C3Mg/bqo27bU2NMppqjuwzUvJ5r91CzoGi9ei:4qo2MQMpwjKB5r9MoDei

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

All of your files have been stolen and encrypted, we have downloaded sensitive and compromising data from your system/network including your financial data and network map. Your files have been encrypted and you won't be able to decrypt them without our help. If you modify the files you won't be able to decrypt them What can I do to get my files back? The price for decription is $10k. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? if you don't know how to Purchase, since you're in south africa binance is the best. download the app and you'll see it's easy to buy bitcoin. You can try whatever you wanna try but don't modify the files, they'll be damaged and impossible to decrypt. it's nothing personal, it's all about money. have a great day. You need contact us and decrypt one file for free, You can contact us using Tox messenger without registration https://tox.chat/download.html. after downloading Tox massenger write to us on this Tox ID EEC1A34EA55C1DBC63D8BCC4779D93BB64FC9036C82210467DEB1948A3ABC2248CE1CAB7A181 Payment information Amount: 10 000 USD Non payment will result in your data being published. YOU HAVE 7 DAYS, AFTER 3 DAYS THE MONEY DOUBLES. Bitcoin Address: bc1qpn32q8a3jykzpfnrv6crqulk7wguaryhxzadqa

URLs

https://tox.chat/download.html

Targets

- Target
  
  2024-09-09_f7171e2e587d97fc079d0afb7ec73634_destroyer_wannacry
- Size
  
  24KB
- MD5
  
  f7171e2e587d97fc079d0afb7ec73634
- SHA1
  
  54fe4810af4babdec3efc2fa7ae3f9c7117be435
- SHA256
  
  bfe508310190495d66f666bc9c65ac4d344a83fa8bb9291563090614aa22a7e5
- SHA512
  
  596c553dd2cab33443ba6ab90004e2593cd10c04f3548af6c99297947114a4312858f67ce3aef5474de0f01b08df9745893b4d7480308f148a397a50047efcaf
- SSDEEP
  
  384:C3Mg/bqo27bU2NMppqjuwzUvJ5r91CzoGi9ei:4qo2MQMpwjKB5r9MoDei
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2