chaos

General

Target

2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry
Size

69KB
Sample

240921-3cnvnszekc
MD5

8e9498d9f1009d82fe20dec5e56e6ab6
SHA1

07fd1c05d1e706a75cb8327bce60524faaf89735
SHA256

24893dc83648dac9acf101c38381fbe5f09dff7788e4cd1d9ac6fc10bde8bb7a
SHA512

26d1e96bb5bb7cc263c5d5f0688a53c537cac9a11893633b62d38213610d0655e76203c8a6fed6f3c795756039fc24df5b534fe978494e531a6b17e34bfab8d8
SSDEEP

1536:fo2yGMhur9i35UbK+X7ryVIxBtNGmD1aBoolWi1UfF:foUMhur9i3MK+X7euBHGmJaBooEF

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

All of your files have been encrypted Your computer was infected with a ransomware and RDP virus. Your files and data have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is $50. Payment can be made in Crypto only. How do I pay, where do I get Crypto? Purchasing Crypto varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Crypto. Many of our customers have reported these sites to be fast and reliable: Cashapp, Coinbase, bicance, Paypal, Kraken Once the payment has been made you can email us and a Decryption key will be sent to you. All Restore Points, Shadow Coppies and recovery mode on ur computer have been deleted/disabled Clients Must pay or sadly ALL data and files are lost, PC Reset will resualt in disabling windows operations If you have any questions please email us, but also remember, we dont make this Ransomeware, just the decryption keys. Email: [email protected] Payment Amount: $50.00 Bitcoin Address: bc1qmxehlpjkuk4xpanapdnsghda2eajdhj0wyvhlc Litecoin Address Lg6PmtU6vusUH3DhYR4QL6h2UtLkzwHrfL Ethereum Address: 0x2ad0e5ABc63d003448Fbe03f580Aa30e5E831d09 Solana Address: 7iKLcDfUqJrbkFk7V1AUQ7RhyyN5qVzv6DWnBvHENW3f

Emails

[email protected]

Targets

- Target
  
  2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry
- Size
  
  69KB
- MD5
  
  8e9498d9f1009d82fe20dec5e56e6ab6
- SHA1
  
  07fd1c05d1e706a75cb8327bce60524faaf89735
- SHA256
  
  24893dc83648dac9acf101c38381fbe5f09dff7788e4cd1d9ac6fc10bde8bb7a
- SHA512
  
  26d1e96bb5bb7cc263c5d5f0688a53c537cac9a11893633b62d38213610d0655e76203c8a6fed6f3c795756039fc24df5b534fe978494e531a6b17e34bfab8d8
- SSDEEP
  
  1536:fo2yGMhur9i35UbK+X7ryVIxBtNGmD1aBoolWi1UfF:foUMhur9i3MK+X7euBHGmJaBooEF
Score

10^/10

chaos ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Renames multiple (207) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2