General
- Target 2025-08-05_a87c070ac4ed43240e2a3d7364129be4_amadey_cobalt-strike_darkgate_elex_helldown_hellokitty_smoke-loader
- Size 586KB
- Sample250805-pwr5jstsaz
- SHA256 58e04dacdc7162cb4194a7b1327ee9bea383c42027723fdf6cbaf3942818fb0b
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\read_me_lkdtt.txt
Ransom Note
- Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.
URLs
-
http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692
Targets
-
- Target 2025-08-05_a87c070ac4ed43240e2a3d7364129be4_amadey_cobalt-strike_darkgate_elex_helldown_hellokitty_smoke-loader
- Size 586KB
- SHA256 58e04dacdc7162cb4194a7b1327ee9bea383c42027723fdf6cbaf3942818fb0b
Score10/10HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
Hellokitty family
Renames multiple (189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.