MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ransomware.VanHelsing


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
SHA3-384 hash: 93741a9d7e921f827238402918077c89676488d5dde625dae77f15544c243b24bdc21b10ac68b3a7b1cafc3176802391
SHA1 hash: e683bfaeb1a695ff9ef1759cf1944fa3bb3b6948
MD5 hash: 3e063dc0de937df5841cb9c2ff3e4651
humanhash: berlin-pennsylvania-minnesota-gee
File name:99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
Download: download sample
Signature Ransomware.VanHelsing
Create hunting rule
File size:736'768 bytes
First seen:2025-03-19 09:28:17 UTC
Last seen:2025-03-19 10:19:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9951b4b852f8bee5d019bc23e6ac6bd6 (1 x Ransomware.VanHelsing)
ssdeep 12288:aKRHZl7Lup6ySk3QYktDNYlg2317DJtY7wdD30qoifK/Ke5ABa4QP9+NrMke03f9:aKslHY7wdD30qnfsKxB+ZKX55WsSuFrl
TLSH T101F4BF3275C0D07BE17211304AAEE6F712BFB631577148DBA7D0562E1A305E2AE32B67
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter TheRavenFile
Tags:exe Ransomware Ransomware.VanHelsing Vanhelsing


Avatar
RakeshKrish12
Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/VanHelsing%20Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
669
Origin country :
IN IN
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2025-03-18_3e063dc0de937df5841cb9c2ff3e4651_avoslocker_cobalt-strike_luca-stealer
Verdict:
No threats detected
Analysis date:
2025-03-18 21:45:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cde01749-c8c2-4dee-8d0e-c322290bf6ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.22799.23425.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d9e96e194f23322a70e726
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Changing a file
Connection attempt
Modifies multiple files
Modifying an executable file
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the default Windows debugger (dwwin.exe)
Encrypting user's files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/67da8e6801edd28374b44bc9/reports/16410223-bb33-46fb-a7c1-7df3132c5f61/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97bbbb2e-4e7b-4d82-ab31-6eb89f252727
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1642710
Signature
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Found Tor onion address
Infects executable files (exe, dll, sys, html)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98/
Threat name:
Win32.Exploit.Generic
Create hunting rule
Status:
Malicious
First seen:
2025-03-18 07:45:42 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
19 of 34 (55.88%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgkzyukb6ywu7o3a57oakjqln2kwmumwhuu4g2cf6q2ycudc7wma._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access discovery ransomware spyware stealer
Link:
https://tria.ge/reports/250319-lfyevaymt3/
Behaviour
Browser Information Discovery
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops desktop.ini file(s)
Credentials from Password Stores: Windows Credential Manager
Reads user/profile data of web browsers
Renames multiple (8330) files with added filename extension
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ab5a447c-355c-4739-8cd2-55a738c8b3e1
Unpacked files
SH256 hash:
99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
MD5 hash:
3e063dc0de937df5841cb9c2ff3e4651
SHA1 hash:
e683bfaeb1a695ff9ef1759cf1944fa3bb3b6948
Link:
https://www.unpac.me/results/22f14c3d-034e-4f92-8d3f-8060c605c07c/
SH256 hash:
38f803929f3400537abce3adb27fb360a562bb58ef6fef5670d8eda1af042cb9
MD5 hash:
901ae11d5e7648350343469a92fad606
SHA1 hash:
29ba6d7d33c1b73033258f5c353e6f3077c45109
Link:
https://www.unpac.me/results/22f14c3d-034e-4f92-8d3f-8060c605c07c/
SH256 hash:
7916c7ad1a33531f941d9ada771ade2f5825ef4fc9f8473f8a988ecb16525dd8
MD5 hash:
2da8ab1192187d1f9cf02aed04b0d0b7
SHA1 hash:
326db513af5a9f898c4870ebbc62e7cd5fd71690
Link:
https://www.unpac.me/results/22f14c3d-034e-4f92-8d3f-8060c605c07c/
SH256 hash:
bf7015462eca2a7b049085ef5879dbabc8ca1eba65e7b84379fb57e392f28f65
MD5 hash:
8fd7848b51ea13322302f7683ab622e3
SHA1 hash:
fe667643d8cf57c228c3eb35a65d5c5c0ad236f8
Link:
https://www.unpac.me/results/22f14c3d-034e-4f92-8d3f-8060c605c07c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/99959c5141f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Ransomware.VanHelsing

zip ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e

Ransomware.VanHelsing

Executable exe 99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98

(this sample)

  
Dropped by
SHA256 ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e
  
Dropped by
MD5 5b28a0fc21ba079b380effb30e853132

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
NET_SHARE_APICan access Network ShareNETAPI32.dll::NetShareEnum
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetFileAttributesW
KERNEL32.dll::FindFirstFileW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegOpenKeyW
ADVAPI32.dll::RegSetKeyValueW
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo

Comments