chaos

General

Target

crynox.exe
Size

599KB
Sample

241214-p5tpqssncs
MD5

f9f3379858516f1ec7c3474dba4cfe13
SHA1

2365e729155dad22856e09275cb94369889d4f14
SHA256

d36c18499800859f77d6c2462a99b6e5e5e066fff95418dce4d5fdb8d45d0106
SHA512

4fcab92050504619a581043023dcbc106a816d1fe134c5f351478295281d08bfc50ab4a77e7c59210aa2bf4b704ffee6b0c27f4d3153703087b86d5a633b2b5b
SSDEEP

12288:1Iw6EkPJU2XGyVdEcIf/vbIGSA4Jxv+T:8SJyIP8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note

CRYNOX Ransomware ======================================= Oh No! Your files has been encrypted. What happened to my files ? All of your files were protected by a strong encryption with RSA & AES More information about the encryption keys using RSA4096 can be found here: RSA : http://en.wikipedia.org/wiki/RSA_(cryptosystem) AES : https://en.wikipedia.org/wiki/Advanced_Encryption_Standard How did this happen ? Specially for your PC was generated personal RSA & AES, both public and private. ALL YOUR FILES were encrypted with High grade cryption. Decrypting of your files is only possible with the help of the key and decryptor, which is on our Secret Server What should I do ? So, there are two ways you can choose: leave your data encrypted, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. https://crynoxaowlkauirfhaaiuefjkebfiaeufaebiefuakbjaiurkjahbfiajkfa.vercel.app/index.html If for some reasons the addresses are not available, follow these steps: 1. Open your email application. After opening the email application : 2. Contact me at : [email protected] 3. Write an email about the ransomware and send it to us. 4. Wait until we replied to you about the decryptor application. ---------------- IMPORTANT INFORMATION------------------------ Support Email : [email protected]

Emails

[email protected]

URLs

https://crynoxaowlkauirfhaaiuefjkebfiaeufaebiefuakbjaiurkjahbfiajkfa.vercel.app/index.html

Targets

- Target
  
  crynox.exe
- Size
  
  599KB
- MD5
  
  f9f3379858516f1ec7c3474dba4cfe13
- SHA1
  
  2365e729155dad22856e09275cb94369889d4f14
- SHA256
  
  d36c18499800859f77d6c2462a99b6e5e5e066fff95418dce4d5fdb8d45d0106
- SHA512
  
  4fcab92050504619a581043023dcbc106a816d1fe134c5f351478295281d08bfc50ab4a77e7c59210aa2bf4b704ffee6b0c27f4d3153703087b86d5a633b2b5b
- SSDEEP
  
  12288:1Iw6EkPJU2XGyVdEcIf/vbIGSA4Jxv+T:8SJyIP8
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (203) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2