Ransomware Research
ChiChi Ransomware
ChiChi is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on November 1, 2021, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- ChiChi
- First Seen
- November 1, 2021
How ChiChi Ransomware Works
Targeted Files
Encrypts first 2Mb 16-byte stripe encryption
File Encryption Patterns
ChiChi modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..chichi..zzzzRansom Note and Payment Demands
After encrypting files, ChiChi displays ransom notes demanding payment for file recovery:
Guide To Recover Your Files.txtRansom message:
notes/Guide To Recover Your Files.txt
Note locations:
EveryFolderHowToDecrypt.txtRansom message:
notes/HowToDecrypt.txt
Note locations:
RootDiscsDesktopTechnical Indicators
Associated Executable Files
The following executable files are associated with ChiChi ransomware:
e_win.exe
Elastio Can Help You
Don't let ChiChi ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This ChiChi ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like ChiChi.
Last updated: July 30, 2025