Overview

overview

10

Static

static

3

2026-06-04...ry.exe

windows10-2004-x64

10

2026-06-04...ry.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry
  • Size 6.1MB
  • Sample260604-1c46jsfy31
  • SHA256 28a0499f3704cb56105f04cc5556b340731acdc9b8c76eca5bff70f290f4e8f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gh0strathellcatpurplefoxcredential_accessdiscoverypersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt

  • hellcat

Ransom Note
  • All your files have been encrypted by the HELLCAT Ransomware Group. This includes documents, source codes, and any other important data on your system. To regain access to your files, you must pay a ransom of $xxx,xxx USD in Monero (XMR) or Bitcoin (BTC). If you fail to make the payment within 336 hours, your files will be permanently encrypted, leaked, and no further attempts to contact us will be entertained. Once you pay, we will provide you with a decryption key that will unlock your files. Failure to comply with these demands will result in irreversible loss of your files. We recommend you act swiftly and make the payment to avoid the permanent loss of your valuable data. Your cooperation is appreciated. If you have any questions or need assistance, refer to the contact information provided below. We will respond to your queries as soon as possible. We are open to negotiating, so feel free to contact us. Your victim hash: xxxxxxxx Providing us with the victim hash will help us prove your identity. If no hash is provided, we won't negotiate. Read this wiki to set up TOX: https://wiki.tox.chat/start Read this wiki to set up XMPP: https://wiki.xmpp.org/web/Main_Page Our Onion site: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion TOX: 898923FE0699CFE1EFD17773425DECB080840877C29F883D389D6880B2B961737FACE98E82E4 XMPP: [email protected] - HELLCAT Ransomware
URLs

  • https://wiki.tox.chat/start

  • https://wiki.xmpp.org/web/Main_Page

  • http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Targets

    • Target
      2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry
    • Size 6.1MB
    • SHA256 28a0499f3704cb56105f04cc5556b340731acdc9b8c76eca5bff70f290f4e8f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoverygh0strathellcatpurplefoxpersistenceransomwareratrootkitspywarestealertrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Family: Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Family: Hellcat

      Hellcat is a cross-platform ransomware written in Golang.

      ransomwarehellcat

    • Family: PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Gh0st RAT payload

    • UPX dump on OEP (original entry point)

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks