helloxd | 4763b93d46ea0d30ce44f40d3bebd186c0560ccc5a880cb8d94eec9198f67673

General

Target
241212-sgd6xsxpf1_pw_infected.zip
Size 32KB
Sample260503-s5e35acw5v
SHA256 4763b93d46ea0d30ce44f40d3bebd186c0560ccc5a880cb8d94eec9198f67673
MD5 95d4a47acd7509c58f4bc39b4a04a1ad
SHA1 b0d7e33c3da49390f3cff0dc70e6cf64e4197144
SHA512 1f002fe19d5e73e80aa1b59cce40ee6f2e34d10d11dce0c23b42885f672511fcf3d0c9348a167e92a58f3031f5c563ad7a6b073c192d50252e226d032067cd91
SSDEEP 768:BT2S3HlU3i+Q7oosjetPFPSgLCf6a35kB9iMjiHmRMfbwZ:ossifnsqtPlun5wiMjiGIbwZ
TLSH
T1A0E2F1F6DD6C12A4C7747E32111ADDAA9043CD5072EAFAA2B30067680673DF07EC8693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Hello.txt

Ransom Note

.;tLG008000000GLt:. .1G80Lt;:.. .,:itC08Ci ,f80t: :f88t. 1@0i 188i .C@t .L@f C@i t@f t@t ..,,:::. .:::,,.. C@i .88..CGG000000G8@; 1@0G000000GGL :@G :@G 0@1.... G@: i@L ....f@L .8@. :@C ,G8t:..,i0@1 f@Gi,..:f@C. 0@. :@C iC0000Gf, :fG0000C; 0@. :@C .. :i111;, ... 0@. :@C :L80GCLCG00f, 0@. ,tCGGCt,,@C f@G;. .i0@t 0@,iLGGGLi t@01;;1G@0@C f@t L@1 0@88f;;if@G, :@G ,f0@f, 8@. ,@G iG@Ci ;@L .0@; .iG@f .8@0000000000000@G :08L: .L@1 ,L@G1. :: ,,,,,,,,,,,,,,,,. .:. :L80i ,f88f, iG@C; iG@G; ,f88f, :L801. ;L80i. ;@@8f :08@@. :@C:: .;.0@. ░█──░█ █──█ █▀▀█ ▀▀█▀▀ 　 ░█─░█ █▀▀█ █▀▀█ █▀▀█ █▀▀ █▀▀▄ ▀█ ░█░█░█ █▀▀█ █▄▄█ ──█── 　 ░█▀▀█ █▄▄█ █──█ █──█ █▀▀ █──█ █▀ ░█▄▀▄█ ▀──▀ ▀──▀ ──▀── 　 ░█─░█ ▀──▀ █▀▀▀ █▀▀▀ ▀▀▀ ▀──▀ ▄─ Not so long ago, we discovered a serious problem with your network and decided to help you. So what happened? All files are encrypted with Integrated Encryption Scheme. The file structure was not damaged. You have been assigned a unique identifier. After infection, you have 96 hours to declare decryption. After the expiration of 96 hours, decryption cost will be automatically increased. █░█ █▀▀ █░░ █░░ █▀█ ▀▄▀ █▀▄ Now you should send us █▀█ ██▄ █▄▄ █▄▄ █▄█ █░█ █▄▀ message with your personal identifier, which is at the bottom of the message. We hope that you understand the importance of the work we have done, if the vulnerability were found by someone else, it is possible that the consequences of the attack could be much more sensitive than the usual payment of money due to us for work. Free decryption as guarantee! Before paying you can send us 2 files for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). ▄▀█ ▀█▀ ▀█▀ █▀▀ █▄░█ ▀█▀ █ █▀█ █▄░█ █ DO!! NOT!! TRY!!! █▀█ ░█░ ░█░ ██▄ █░▀█ ░█░ █ █▄█ █░▀█ ▄ TO!! CHANGE!! or apply any other influence encrypted files by yourself!!! If you willtry to use any third party software for restoring your data or antivirus solutions - this can lead to complete damage to all files and their irrecoverable loss, since it will no longer be possible to restore them Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. ...!XD :: your personal id: 9889E042B07F83DA :: our TOX below >:) A746E398A5BC9AD9F281F5D10CF861546092D0F2107F12EA9F107EFB7D21CA41F312B73FB114 You can download TOX here: https://tox.chat/download.html

URLs

https://tox.chat/download.html

Targets

- Target
  xd.exe
- Size 42KB
- SHA256 903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74
- MD5 a034f79273e3f61d34eeadf38f12dee2
- SHA1 9c8feeab65f71344713d63f4879e247aba49dce4
- SHA512 f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf
- SSDEEP 768:nlAjKF79vhgBT1ImAliLzgi/gJ+j7hFImodEp3lrbJFq/:2jKFleBTDAliwi/N2grbJFq/
- TLSH
  T15B13DF8AB630C041E8858FF84D6BC2540526FF195CA4032E3A9FFB7D3F75B368894A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution helloxd impact ransomware spyware stealer
- Family: HelloXD
  HelloXD is a ransomware.
  ransomware helloxd
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9669) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1