Chaos Ransomware encrypts user files with AES and RSA and demands 2000 yen roughly ~$17 in pre-paid cards. It is currently focused on Japan and spread via Minecraft Gamers Alts. Its ransom demands are too low for a ransomware. Pre-paid cards are readily available in Japan. Chaos Ransomware encrypt file that are less than 2MB in size, if the file size is larger this it inject random bytes in the file making it unrecoverable even if a ransom is paid. Due to the destructive nature of the attack, those who pay the ransom can only recover smaller files. It appends four random characters or digits as the extension to encrypted files.
Chaos Ransomware Signatures
Family: Ransom:MSIL/Filecoder.PK!MSR
MD5: 1c05055e3c055463114528505820dae3
SHA256: aacce549a756cd942ee79f57625d0902ce79315f4e4bfb1381afa208599d7be5
Chaos Ransomware Download
