General
- Target 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe
- Size 473KB
- Sample250410-k6s3daxtbv
- SHA256 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\read_me_lkdtt.txt
Ransom Note
- Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.
URLs
-
http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692
Targets
-
- Target 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe
- Size 473KB
- SHA256 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4
Score10/10-
HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
-
Hellokitty family
-
Renames multiple (158) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.