MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Ransomware.VanHelsing

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e
SHA3-384 hash:	bcd74a755e083f5ac9dc9edbbaf7782fa1a6b6954ed31d78fcad4e54dba6a7a0228a2048525b624c7f16c1ba665505aa
SHA1 hash:	0d92859888623085412b65452751b1a360b0a19b
MD5 hash:	5b28a0fc21ba079b380effb30e853132
humanhash:	uranus-neptune-leopard-eighteen
File name:	99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98.zip
Download:	download sample
Signature	Ransomware.VanHelsing Create hunting rule
File size:	400'395 bytes
First seen:	2025-03-26 08:32:57 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	6144:pfcNopBmAdHlY0/lIjoWBfMH38eDS8wQQShs/YaaLgMNyZM40W8xig7zxiP:lcNo9q0WjoWVMHMGNUhkPU8xv7zxy
TLSH	T12D8423A544C2AF5767FEAAFB71B938E84D79A455073F503206CCB98CECFD4AC0112282
Magika	zip
Reporter	ins3cto
Tags:	exe Ransomware Ransomware.VanHelsing Vanhelsing zip

Intelligence

File Origin

# of uploads :

# of downloads :

605

Origin country :

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 1 file(s), sorted by their relevance:

File name:	99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98.bin
File size:	736'768 bytes
SHA256 hash:	99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
MD5 hash:	3e063dc0de937df5841cb9c2ff3e4651
MIME type:	application/x-dosexec
Signature	Ransomware.VanHelsing

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d9e96e194f23322a70e726

Tags:

n/a

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/67e3bbd0f274bf2d8e229fed/reports/91bd6150-95e9-451a-9b24-a43702956e8b/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

10/10

Tags:

credential_access discovery ransomware spyware stealer

Link:

https://tria.ge/reports/250326-ns3w7sxpt5/

Behaviour

Browser Information Discovery

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops desktop.ini file(s)

Credentials from Password Stores: Windows Credential Manager

Reads user/profile data of web browsers

Renames multiple (8378) files with added filename extension

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

SNC

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ffb25d80448f13a089832e2ae2f946cb454c7cbbf466fdd9d3cf4caab1e0a93e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)