MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HelloXD


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3
SHA3-384 hash: 4c3ecdd97d3d821f701606271cd5faea409688b08cb8f06e12ca505a0b78906caf2e81d93b09fb8d5c5c7a9a4ff6617d
SHA1 hash: 9785231ebf3d00216aa979f8c705e2513568802e
MD5 hash: 93cb0fa81ed42d4c44fac49dd0354d0b
humanhash: oklahoma-oxygen-mobile-don
File name:65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3.bin
Download: download sample
Signature HelloXD
Create hunting rule
File size:156'672 bytes
First seen:2021-12-29 00:05:00 UTC
Last seen:2022-06-14 07:40:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b244bf9042a5dc34867b521d46e2f128 (2 x HelloXD)
ssdeep 3072:/uMGy1F1ld/zcQihU1xgG4zMtm3ffkxdViDbhS/DIyhN9HzJ7EC7bEFqHD:/6y1Pbc92gG1Kf2dwUIcnzJ7EqbEFq
TLSH T104E30185751948B6C45B11309A6BD88A2A34FE246FC1A82E349FF77E3A31777DD3CA10
File icon (PE):PE icon
dhash icon 82f0f0d4cccce070 (7 x HelloXD)
Reporter Arkbird_SOLG
Tags:exe Hello HelloXD HelloXD x4k Ransomware

Intelligence

File Origin
# of uploads :
4
# of downloads :
314
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3.bin
Verdict:
No threats detected
Analysis date:
2021-12-29 00:09:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7c9179a8-81be-4012-85f0-d0ce495cb7d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216713/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Creating a file in the %AppData% directory
Deleting a recently created file
Replacing files
Running batch commands
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Changing a file
Creating a file in the Program Files directory
Modifying an executable file
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Creating a window
Deleting volume shadow copies
Forced shutdown of a browser
Encrypting user's files
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3416/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
anti-debug filecoder packed
Link:
https://www.filescan.io/uploads/61cba632ec6c6c14a9fa2c75/reports/5cc7b9e7-a25e-4de3-8fa0-d497cab6ee6e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a87ba04-f74f-48df-a00e-af2d9147952e
Result
Threat name:
Hello Ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/913599
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Deletes shadow drive data (may be related to ransomware)
Detected unpacking (changes PE section rights)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Machine Learning detection for sample
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Self deletion via cmd delete
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Hello Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546077 Sample: XpAAVqov0e.bin Startdate: 29/12/2021 Architecture: WINDOWS Score: 100 38 Multi AV Scanner detection for dropped file 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected Hello Ransomware 2->42 44 7 other signatures 2->44 8 XpAAVqov0e.exe 2 2->8         started        process3 file4 30 C:\Users\user\Desktop\temp, PE32+ 8->30 dropped 32 C:\Users\user\AppData\Roaming\dummy.txt, PE32+ 8->32 dropped 50 Detected unpacking (changes PE section rights) 8->50 52 Self deletion via cmd delete 8->52 54 Writes to foreign memory regions 8->54 56 2 other signatures 8->56 12 dummy.txt 502 8->12         started        16 cmd.exe 1 8->16         started        signatures5 process6 file7 34 C:\Hello.txt, UTF-8 12->34 dropped 58 Multi AV Scanner detection for dropped file 12->58 60 Machine Learning detection for dropped file 12->60 62 Found hidden mapped module (file has been removed from disk) 12->62 18 cmd.exe 1 12->18         started        64 May disable shadow drive data (uses vssadmin) 16->64 66 Uses ping.exe to sleep 16->66 68 Deletes shadow drive data (may be related to ransomware) 16->68 70 Uses ping.exe to check the status of other devices and networks 16->70 21 PING.EXE 1 16->21         started        24 conhost.exe 16->24         started        signatures8 process9 dnsIp10 46 May disable shadow drive data (uses vssadmin) 18->46 48 Deletes shadow drive data (may be related to ransomware) 18->48 26 conhost.exe 18->26         started        28 vssadmin.exe 1 18->28         started        36 1.1.1.1 CLOUDFLARENETUS Australia 21->36 signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3/
Threat name:
Win64.Trojan.Goppel
Create hunting rule
Status:
Malicious
First seen:
2021-12-03 03:16:13 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxgl2y735fxkrayds3cxletk6r3may2sxoeptqrpsdphxoctm2rq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211229-ac7nkaecf4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3
MD5 hash:
93cb0fa81ed42d4c44fac49dd0354d0b
SHA1 hash:
9785231ebf3d00216aa979f8c705e2513568802e
Link:
https://www.unpac.me/results/f93bdb77-7999-48d5-a87f-3385e89a6ce3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/65ccbd63fbe9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216713/

Comments