hellokitty | 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4

General

Target

2024-09-09_a3dc8739c25b9b0c0348fc12fddcef65_cobalt-strike_hellokitty
Size

473KB
Sample

240909-q3znmstdjc
MD5

a3dc8739c25b9b0c0348fc12fddcef65
SHA1

37fa81ea2346e2110715c604d451097b95bb4698
SHA256

4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4
SHA512

e75715dbfd4ad26cf0ed0666c3f293963eafdcd94847346e5a3104b53018155d41cca9220147e5f23621abb9955d496c5aa83edad572b56bc9e3d401cfe6323f
SSDEEP

3072:WLObLmjqGR2l/mlHaMwGkHJhqDLcClct:WLkLmjqGk/m2ghlC

Score

10^/10

Malware Config

Extracted

Path

C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\read_me_lkdtt.txt

Ransom Note

Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.

URLs

http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692

Targets

- Target
  
  2024-09-09_a3dc8739c25b9b0c0348fc12fddcef65_cobalt-strike_hellokitty
- Size
  
  473KB
- MD5
  
  a3dc8739c25b9b0c0348fc12fddcef65
- SHA1
  
  37fa81ea2346e2110715c604d451097b95bb4698
- SHA256
  
  4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4
- SHA512
  
  e75715dbfd4ad26cf0ed0666c3f293963eafdcd94847346e5a3104b53018155d41cca9220147e5f23621abb9955d496c5aa83edad572b56bc9e3d401cfe6323f
- SSDEEP
  
  3072:WLObLmjqGR2l/mlHaMwGkHJhqDLcClct:WLkLmjqGk/m2ghlC
Score

10^/10

hellokitty discovery ransomware
- HelloKitty Ransomware
  Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
  ransomware hellokitty
- Renames multiple (188) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2