chaos

General

Target

2024-10-18_796e7bcc691f6c21d235ae0c301b1081_destroyer_wannacry
Size

23KB
Sample

241018-w4wk9ssamg
MD5

796e7bcc691f6c21d235ae0c301b1081
SHA1

7ef3bf6e556cbe7261abe797a0a3bb588cd09067
SHA256

ff231952158f7314a3e73e46b92843e98ceff8d396092873d02eb98d0705da49
SHA512

e5e7848208ed1377de2af39aeedf1e40a684de52699faa0c4445f66037f7c7ee884d96fb2d159f7432dbb2794a651c0e9375e7bb6152c68a423b14c631d245eb
SSDEEP

384:+3Mg/bqo2Y5FOieDopGSkobJJ3r91CvpIBVjqe0:8qo2+FOBopjH3r9KIB4e0

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Ransom Note

All of your files have been stolen and encrypted. in a nutshell you're Hacked You can try whatever you wanna try but don't modify the files, they'll be damaged and impossible to decrypt. it's nothing personal, it's all about money. have a great day. Payment information Non payment will result in your data being published. YOU HAVE 7 DAYS, AFTER 3 DAYS THE MONEY DOUBLES. Bitcoin Address: bc1qpn32q8a3jykzpfnrv6crqulk7wguaryhxzadqa You must contact us using Tox messenger, download it here> https://tox.chat/download.html. Invite us on Tox, Our Tox ID : EEC1A34EA55C1DBC63D8BCC4779D93BB64FC9036C82210467DEB1948A3ABC2248CE1CAB7A181 Or contact us via email on [email protected] You need to contact us and decrypt one file for free on TOX messenger with your personal DECRYPTION ID 102121515

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  
  2024-10-18_796e7bcc691f6c21d235ae0c301b1081_destroyer_wannacry
- Size
  
  23KB
- MD5
  
  796e7bcc691f6c21d235ae0c301b1081
- SHA1
  
  7ef3bf6e556cbe7261abe797a0a3bb588cd09067
- SHA256
  
  ff231952158f7314a3e73e46b92843e98ceff8d396092873d02eb98d0705da49
- SHA512
  
  e5e7848208ed1377de2af39aeedf1e40a684de52699faa0c4445f66037f7c7ee884d96fb2d159f7432dbb2794a651c0e9375e7bb6152c68a423b14c631d245eb
- SSDEEP
  
  384:+3Mg/bqo2Y5FOieDopGSkobJJ3r91CvpIBVjqe0:8qo2+FOBopjH3r9KIB4e0
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2