chaos

General

Target

2024-09-18_2136851bb03a3f5b5dfeb64558e2074a_chaos_destroyer_wannacry
Size

25KB
Sample

240918-wz4fbawfrk
MD5

2136851bb03a3f5b5dfeb64558e2074a
SHA1

992bb4b51f2ef49508dff162bf75a53450dde994
SHA256

a3c442d58a5b6f05a7faf34b88b8c1ea2aeab52f76cd22ebbb4bc611fbac99ae
SHA512

85cbf62b565bd3a0a624ddcc1c48f93d5cce8c59a54658ec28a5323ee269b1db9bdf49968c32728ebac54179c3cc8617310acb7dde439f0907589aae699c5356
SSDEEP

384:o3Mg/bqo2shyDpqyJOjPJDRr91CKnZKurAy3Yrek:Wqo2KipVOjhNr9PZKurEek

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\DECRYPTION INFORMATION.txt

Ransom Note

All of your files have been encrypted! Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $100. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - https://www.coinmama.com Bitpanda - https://www.bitpanda.com Payment information Amount: 0.0017 BTC ($100) Bitcoin Address: bc1q909n8v9tmhfnh5ptrfjqjum2tp9tuucag6ldvm Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software - it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. Our company values its reputation. We give all guarantees of your files decryption. What are your recommendations? - Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them. - Never work with intermediary companies because they charge you more money. Have a nice day :)

URLs

https://www.coinmama.com

https://www.bitpanda.com

Targets

- Target
  
  2024-09-18_2136851bb03a3f5b5dfeb64558e2074a_chaos_destroyer_wannacry
- Size
  
  25KB
- MD5
  
  2136851bb03a3f5b5dfeb64558e2074a
- SHA1
  
  992bb4b51f2ef49508dff162bf75a53450dde994
- SHA256
  
  a3c442d58a5b6f05a7faf34b88b8c1ea2aeab52f76cd22ebbb4bc611fbac99ae
- SHA512
  
  85cbf62b565bd3a0a624ddcc1c48f93d5cce8c59a54658ec28a5323ee269b1db9bdf49968c32728ebac54179c3cc8617310acb7dde439f0907589aae699c5356
- SSDEEP
  
  384:o3Mg/bqo2shyDpqyJOjPJDRr91CKnZKurAy3Yrek:Wqo2KipVOjhNr9PZKurEek
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (221) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2