chaos

General

Target

crynox.exe
Size

299KB
Sample

241213-ra7n8aslhm
MD5

e6e2f46331a60acfc399f10ff842345d
SHA1

514945da2f3518753b22df05786e6dce446d7ec1
SHA256

c50584f0f5cccb28d192fb2540077792732b8afe1eb887cc3657d60980d9ad02
SHA512

08842cb745dc04c6a2f0233b69647502cdc2920c2f520415507b98d54b7086f15282ba177baf93c11fbd6415467f1fb84df5a05a8d1923f47737344b6843333c
SSDEEP

3072:drQkc9kuFo+p2afIyTBjMnuNjg710OpYVm/+FbN/damWsJ7gUev+Tvx:95c9Vf2qIuNLiapdz1JMdv+T

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\Decrypt_My_File.txt

Ransom Note

CRYNOX Ransomware ======================================= Oh No! Your files has been encrypted. What happened to my files ? All of your files were protected by a strong encryption with RSA & AES More information about the encryption keys using RSA4096 can be found here: RSA : http://en.wikipedia.org/wiki/RSA_(cryptosystem) AES : https://en.wikipedia.org/wiki/Advanced_Encryption_Standard How did this happen ? Specially for your PC was generated personal RSA & AES, both public and private. ALL YOUR FILES were encrypted with High grade cryption. Decrypting of your files is only possible with the help of the key and decryptor, which is on our Secret Server What do I do ? So, there are two ways you can choose: leave your data encrypted, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. https://crynoxaowlkauirfhaaiuefjkebfiaeufaebiefuakbjaiurkjahbfiajkfa.vercel.app/decryptor.html If for some reasons the addresses are not available, follow these steps: 1. Open your email application. After opening the email application : 2. Contact me at : [email protected] 3. Write an email about the ransomware and send it to us. 4. Wait until we replied to you about the decryptor application. ---------------- IMPORTANT INFORMATION------------------------ Support Email : [email protected]

Emails

[email protected]

URLs

https://crynoxaowlkauirfhaaiuefjkebfiaeufaebiefuakbjaiurkjahbfiajkfa.vercel.app/decryptor.html

Targets

- Target
  
  crynox.exe
- Size
  
  299KB
- MD5
  
  e6e2f46331a60acfc399f10ff842345d
- SHA1
  
  514945da2f3518753b22df05786e6dce446d7ec1
- SHA256
  
  c50584f0f5cccb28d192fb2540077792732b8afe1eb887cc3657d60980d9ad02
- SHA512
  
  08842cb745dc04c6a2f0233b69647502cdc2920c2f520415507b98d54b7086f15282ba177baf93c11fbd6415467f1fb84df5a05a8d1923f47737344b6843333c
- SSDEEP
  
  3072:drQkc9kuFo+p2afIyTBjMnuNjg710OpYVm/+FbN/damWsJ7gUev+Tvx:95c9Vf2qIuNLiapdz1JMdv+T
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (217) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2