a little suggestion

[EternalBlueHX]

i discovered a new ransomware from the Chaos Ransomware family called "Black Black Ransomware" on discord here: https://www.mediafire.com/file/y16le3bftqg2kbu/black.exe/file btw hi :D

[ZeroDayFORGE-Lab]

Title: New Chaos Ransomware Variant — "Black Black" (SHA256: 22488e9d...ca6e125)

Body:

Summary

A new Chaos ransomware variant dubbed "Black Black Ransomware" was distributed via Discord and hosted on MediaFire. The sample is a 208 KB PE32 executable flagged as malicious by VirusTotal.

Sample Details

Field	Value
Filename	black.exe
File Size	208 KB (213,056 bytes)
SHA256	22488e9d3eb5a776f49c0d50156660cbe1e3b376a7d9fa69242cfd55caf6e125
Upload Date	April 24, 2026
Distribution	Discord → MediaFire
Download URL	https://www.mediafire.com/file/y16le3bftqg2kbu/black.exe/file

Family Attribution

• Family: Chaos Ransomware (also known as Yashma/Ryuk builder variants)
• Context: Over 350 new ransomware strains were discovered in 2025, mostly based on Chaos, MedusaLocker, and Makop families (source: Cyble 2025-2026 threat report)
• The modern Chaos RaaS group (unrelated to the old builder) emerged Feb 2025, with ties to former BlackSuit/Royal operators per Cisco Talos

Known Chaos Ransomware Characteristics (from this build family)

• AES-RSA hybrid encryption
• Shadow copy deletion (vssadmin, wmic, bcdedit, wbadmin)
• Disables Windows Recovery, Task Manager, Backup & AV services
• Spreads via removable drives
• Adds to startup registry
• Wallpaper replacement
• Cryptocurrency clipper function in stub
• Multi-threaded encryption with selective targeting

Suggested Actions

• Add/update YARA rules for this variant hash
• Verify if existing Chaos detection rules (EQL/behavior) catch this sample
• Submit sample to MalwareBazaar for community sharing

References

• https://blog.talosintelligence.com/new-chaos-ransomware/ (Talos, Jul 2025)
• https://github.com/HeightCoder/Chaos-Ransomware-Builder (Chaos builder source)
• https://cyble.com/knowledge-hub/10-new-ransomware-groups-of-2025-threat-trend-2026/
• https://malpedia.caad.fkie.fraunhofer.de/details/win.chaos

Other places you should submit this sample:

MalwareBazaar — Upload the sample so the wider community can access it: https://bazaar.abuse.ch/upload/
theZoo — Submit via python prep_file.py black.exe and email to thezoo-submissions [at] morirt [dot] com | Repo: https://github.com/ytisf/theZoo
Any.Run — Already may have detection; you can run it in their sandbox to generate a public report

Quick behavioral expectations based on Chaos builder analysis:

Persistence: Adds itself to HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Defense evasion: Attempts to stop WinDefend, VSS, wbengine services
Encryption: Targets docs, images, DB files, archives; appends custom extension and drops a ransom note
Propagation: Copies itself to removable drives via AUTOINF/spread mechanism