Ransomware Tracker (Entry #238): Chaos v2.0
Entry: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/chaos-v20
Note: This page is dedicated to the Chaos v2.0 ransomware builder and does not reflect any encryptors created from the builder.
Note: This is the second iteration of the Chaos ransomware builder series. For preliminary information, see the Chaos v1.0 entry.
The Chaos v2.0 builder is similar to Chaos v1.0. It still wipes all the files by overwriting them with randomly generated data. However, it differs in a few subtle ways:
- The builder is officially renamed Chaos Ransomware Builder instead of Ryuk.NET Ransomware Builder.
- The About section in the builder states that the builder creates wiper files, not ransomware, eliminating the "Imitation" aspect.
- Allows users to change the ransom note file name.
- Advanced Options allow users to delay execution time, enforce execution with admin privileges, and delete shadow copies and backup files.
- Tweak how the random data is generated for wiping.
