hellokitty | a022e86b2bb3ed6b4a8676be8b1688397b6e15c693e69c5093d8eb04396d2905

General

Target

a022e86b2bb3ed6b4a8676be8b1688397b6e15c693e69c5093d8eb04396d2905
Size

473KB
Sample

240909-sxatfavgnn
MD5

a169a146571b908a412ba8482adee8f1
SHA1

47cd550be7567b8ff091fff32cd0d7c3c0e4f7d2
SHA256

a022e86b2bb3ed6b4a8676be8b1688397b6e15c693e69c5093d8eb04396d2905
SHA512

03e7df0b082efedf5eeca67c9333fe3ad404a66ed33a13f5105cb0774f18351fff3f30860dedd3640e8e66123fdb5a430d33ddb2c92e5ef1d268fe806d6d3999
SSDEEP

1536:heTmjxb5QIul2hD/S8+5hFg2NRrlSYDLGRxHwEEaY4qr6leWvebuFD0MCu7sWZc:19b45hmjqGR2l/mlHaMwGkHJhqDLcCl

Score

10^/10

Malware Config

Extracted

Path

C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\read_me_lkdtt.txt

Ransom Note

Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.

URLs

http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692

Targets

- Target
  
  a022e86b2bb3ed6b4a8676be8b1688397b6e15c693e69c5093d8eb04396d2905
- Size
  
  473KB
- MD5
  
  a169a146571b908a412ba8482adee8f1
- SHA1
  
  47cd550be7567b8ff091fff32cd0d7c3c0e4f7d2
- SHA256
  
  a022e86b2bb3ed6b4a8676be8b1688397b6e15c693e69c5093d8eb04396d2905
- SHA512
  
  03e7df0b082efedf5eeca67c9333fe3ad404a66ed33a13f5105cb0774f18351fff3f30860dedd3640e8e66123fdb5a430d33ddb2c92e5ef1d268fe806d6d3999
- SSDEEP
  
  1536:heTmjxb5QIul2hD/S8+5hFg2NRrlSYDLGRxHwEEaY4qr6leWvebuFD0MCu7sWZc:19b45hmjqGR2l/mlHaMwGkHJhqDLcCl
Score

10^/10

hellokitty discovery ransomware
- HelloKitty Ransomware
  Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
  ransomware hellokitty
- Renames multiple (215) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2