chaos

General

Target

2024-12-09_b6db59aed6a103fa87f454355284a96c_destroyer_wannacry
Size

27KB
Sample

241209-yaz3psyldt
MD5

b6db59aed6a103fa87f454355284a96c
SHA1

d0418cd34b979a819b9a2f1cae55b88b781e44bd
SHA256

0d903dafadeb4a3908b2d74967b139565114ba28aaf3bb264f24fd1bf2f15f7e
SHA512

77eccd8d76914f9c208d235cff74571391683e932d266ef28b92e1751a42144bf630b2f8eca5d26b96e31ddc9e7aecf62ad832cf27dd9cca3b2b15e5fc65658e
SSDEEP

384:UDtWZPzzxAm1vp5ZRoDMS74WtRQUxhhlsNpGVol7Oy5o91dLrpZ82vy:U67zxAmpfyMS1RQUxGN44ho9L7826

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-12-09_b6db59aed6a103fa87f454355284a96c_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  b6db59aed6a103fa87f454355284a96c
- SHA1
  
  d0418cd34b979a819b9a2f1cae55b88b781e44bd
- SHA256
  
  0d903dafadeb4a3908b2d74967b139565114ba28aaf3bb264f24fd1bf2f15f7e
- SHA512
  
  77eccd8d76914f9c208d235cff74571391683e932d266ef28b92e1751a42144bf630b2f8eca5d26b96e31ddc9e7aecf62ad832cf27dd9cca3b2b15e5fc65658e
- SSDEEP
  
  384:UDtWZPzzxAm1vp5ZRoDMS74WtRQUxhhlsNpGVol7Oy5o91dLrpZ82vy:U67zxAmpfyMS1RQUxGN44ho9L7826
Score

10^/10

chaos persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2