MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HelloKitty


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8
SHA3-384 hash: 33d3f76eeb23176ab3d0087ecc3108827eefbe0f9646b7237dade4fae76b052b51bad53ce0fcb1d4568ae54731af75f9
SHA1 hash: a0181227dcb49b9417b468eeb38a2f8655553409
MD5 hash: 22d35005e926fe29379cb07b810a6075
humanhash: yellow-lake-texas-california
File name:947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8.bin
Download: download sample
Signature HelloKitty
Create hunting rule
File size:255'504 bytes
First seen:2021-12-22 14:33:01 UTC
Last seen:2025-04-10 08:30:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8517cf209c905e801241690648f36a97 (9 x HelloKitty)
ssdeep 6144:YVgUc9JwBsH2/XOjwxhAjTkACvCXMSHp6oPyD9Yw:Y09WBsH6XOjwAsACwFd2yw
Threatray 5 similar samples on MalwareBazaar
TLSH T1E544E101B4D1C473D9B34E3204B6EDB58EBEF9384F2198AB37D812394E745E0993996B
Reporter Arkbird_SOLG
Tags:exe HelloKitty

Intelligence

File Origin
# of uploads :
2
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
tanker.exe
Verdict:
No threats detected
Analysis date:
2021-04-06 11:41:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ce274eab-3378-4c8e-8ae4-b761eee9b260

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/215797/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2946/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
apt greyware hellokitty overlay packed
Link:
https://www.filescan.io/uploads/61c337218991ba72b392164e/reports/06574385-115b-4288-9309-8daccbd320a2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SOMBRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/74ff7ee2-f1d7-4d01-bd4f-b2533c42be33
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/911565
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8/
Threat name:
Win32.Ransomware.HelloKitty
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 17:40:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sr7dk6757zarxzwjpl3flh6rzxc4tvxvz2qsfpyxjuje5yb5fxua._file
Verdict:
suspicious
Similar samples:
bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4
HelloKitty
c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323
HelloKitty
f1b331ce095f866190320d808a3be8176209ad0f8a9422d6d711431b3a87aacc
HelloKitty
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211222-rwwh3sgcdm/
Unpacked files
SH256 hash:
947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8
MD5 hash:
22d35005e926fe29379cb07b810a6075
SHA1 hash:
a0181227dcb49b9417b468eeb38a2f8655553409
Link:
https://www.unpac.me/results/79604f7d-8715-423f-a688-f0ca6963401b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1
Create hunting rule
Author:Florian Roth
Description:Detects HelloKitty Ransomware samples from UNC2447 campaign
Reference:https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
Rule name:APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1_RID3455
Create hunting rule
Author:Florian Roth
Description:Detects HelloKitty Ransomware samples from UNC2447 campaign
Reference:https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/215797/

Comments