Overview

overview

10

Static

static

3

b8e71845cc...e7.exe

windows10-2004-x64

10

b8e71845cc...e7.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    250912-f88tdsypv2_pw_infected.zip
  • Size 1.7MB
  • Sample251013-ke728adk8v
  • SHA256 393b3d8bdb6e9e0f4e91c68f8e9466c5c8a5289b2ae0e0ed8e63bb9d6d1d56f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hellcatcredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Adobe\Color\_README_HELLCAT_.txt

  • hellcat

Ransom Note
  • All your files have been encrypted by the HELLCAT Ransomware Group. This includes documents, source codes, and any other important data on your system. To regain access to your files, you must pay a ransom of $xxx,xxx USD in Monero (XMR) or Bitcoin (BTC). If you fail to make the payment within 336 hours, your files will be permanently encrypted, leaked, and no further attempts to contact us will be entertained. Once you pay, we will provide you with a decryption key that will unlock your files. Failure to comply with these demands will result in irreversible loss of your files. We recommend you act swiftly and make the payment to avoid the permanent loss of your valuable data. Your cooperation is appreciated. If you have any questions or need assistance, refer to the contact information provided below. We will respond to your queries as soon as possible. We are open to negotiating, so feel free to contact us. Your victim hash: xxxxxxxx Providing us with the victim hash will help us prove your identity. If no hash is provided, we won't negotiate. Read this wiki to set up TOX: https://wiki.tox.chat/start Read this wiki to set up XMPP: https://wiki.xmpp.org/web/Main_Page Our Onion site: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion TOX: 898923FE0699CFE1EFD17773425DECB080840877C29F883D389D6880B2B961737FACE98E82E4 XMPP: [email protected] - HELLCAT Ransomware
URLs

  • https://wiki.tox.chat/start

  • https://wiki.xmpp.org/web/Main_Page

  • http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Targets

    • Target
      b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
    • Size 2.8MB
    • SHA256 b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionhellcatimpactransomwarespywarestealer

    • Hellcat

      Hellcat is a cross-platform ransomware written in Golang.

      ransomwarehellcat

    • Hellcat family

      hellcat

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks