chaos

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

rule ransomware_win_chaos {
    meta:
        id = "c1876a18-0618-44e2-8919-b4a041de97e7"
        description = "Detects the Chaos Ransomware"
        author = "Sekoia.io"
        version = "1.0"
        creation_date = "2022-01-18"
        classification = "TLP:CLEAR"
        
    strings:
        $rep00 = "\\Desktop" wide
        $rep01 = "\\Links" wide
        $rep02 = "\\Contacts" wide
        $rep03 = "\\Documents" wide
        $rep04 = "\\Downloads" wide
        $rep05 = "\\Pictures" wide
        $rep06 = "\\Music" wide
        $rep07 = "\\OneDrive" wide
        $rep08 = "\\Saved Games" wide
        $rep09 = "\\Favorites" wide
        $rep10 = "\\Searches" wide
        $rep11 = "\\Videos" wide
        $rep12 = "C:\\Users\\" wide
        
        $str0 = "svchost.exe" wide
        $str1 = "\\privateKey.chaos" wide
        $str2 = "Chaos Ransomware" wide
        $str3 = "read_it.txt" wide
        $str4 = "<EncryptedKey>" wide
        $str5 = "passwordBytes" ascii
        $str6 = "lookForDirectories" ascii
        $str7 = "Rfc2898DeriveBytes" ascii
        $str8 = "ICryptoTransform" ascii
        $str9 = "FromBase64String" ascii
        
        $ext0 = ".torrent" wide
        $ext1 = ".ibank" wide
        $ext2 = ".wallet" wide
        $ext3 = ".swift" wide
        $ext4 = ".onetoc2" wide
        
    condition:
        uint16(0) == 0x5a4d and
    filesize > 50KB and filesize < 2MB and
        6 of ($str*) and 10 of ($rep*) and 4 of ($ext*)
}
        

Hello,
Our name is Chaos, and we would like to inform you about an important issue regarding the security of your systems.We conducted a professional security test, which fortunately was successful.
The system's protection failed to function properly, and as a result, all confidential data was downloaded, including financial reports, internal communications, client databases, and other crucial materials that could have a significant impact on your business.
This is not just a matter of lost information, but also potential legaland reputational consequences.
We fully understand that the leakage of such data could lead to serious issues for your company.
However, there is an opportunity to resolve this situation while keeping all information confidentialand preventing further leakage.
To achieve this, a few steps need to be taken.
We offer a peaceful resolution to the matter, ensuring that all data remains confidential.
In exchange for compensation, all issues will be closed, and there will be no consequences for your company.
This is the only way to avoid severe problems.
To discuss further, please follow the link below with TOR Browser to get in touch with me.There, we can go over the details:
	[redactado]

• https://www.ransomware.live/group/chaos

• Technology
  6
• Manufacturing
  4
• Not Found
  4
• Healthcare
  4