General
- Target 2024-12-09_b6db59aed6a103fa87f454355284a96c_destroyer_wannacry
- Size 27KB
- Sample241209-yaz3psyldt
- SHA256 0d903dafadeb4a3908b2d74967b139565114ba28aaf3bb264f24fd1bf2f15f7e
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
Ransom Note
- Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)
Targets
-
- Target 2024-12-09_b6db59aed6a103fa87f454355284a96c_destroyer_wannacry
- Size 27KB
- SHA256 0d903dafadeb4a3908b2d74967b139565114ba28aaf3bb264f24fd1bf2f15f7e
Score10/10Chaos
Ransomware family first seen in June 2021.
Chaos Ransomware
Chaos family
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Drops desktop.ini file(s)