SYMBOLCOMMON_NAMEaka. SYNONYMS
win.hellokitty (Back to overview)

HelloKitty

aka: KittyCrypt
VTCollection    

Unit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Windows systems. The malware family got its name due to its use of a Mutex with the same name: HelloKittyMutex. The ransomware samples seem to evolve quickly and frequently, with different versions making use of the .crypted or .kitty file extensions for encrypted files. Some newer samples make use of a Golang packer that ensures the final ransomware code is only loaded in memory, most likely to evade detection by security solutions.

References
2023-12-13 ⋅ cocomelonc ⋅ cocomelonc
Malware in the wild book
AsyncRAT Babuk BlackCat BlackLotus Carbanak HelloKitty Paradise Stealc WinDealer
2023-02-14 ⋅ Intrinsec ⋅ CTI Intrinsec, Intrinsec
Vice-Society spreads its own ransomware
HelloKitty PolyVice Zeppelin
2023-01-04 ⋅ cocomelonc
Malware development tricks: part 26. Mutex. C++ example.
AsyncRAT Conti HelloKitty
2022-09-20 ⋅ vmware ⋅ Dana Behling
Threat Report: Illuminating Volume Shadow Deletion
Conti HelloKitty
2022-09-06 ⋅ CISA ⋅ CISA, FBI, MS-ISAC, US-CERT
Alert (AA22-249A) #StopRansomware: Vice Society
Cobalt Strike Empire Downloader FiveHands HelloKitty SystemBC Zeppelin
2022-05-20 ⋅ AdvIntel ⋅ Marley Smith, Vitali Kremez, Yelisey Boguslavskiy
DisCONTInued: The End of Conti’s Brand Marks New Chapter For Cybercrime Landscape
AvosLocker Black Basta BlackByte BlackCat Conti HelloKitty Hive
2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-05-01 ⋅ BushidoToken ⋅ BushidoToken
Gamer Cheater Hacker Spy
Egregor HelloKitty NetfilterRootkit RagnarLocker Winnti
2022-04-25 ⋅ Medium proferosec-osm ⋅ Brenton Morris
Static unpacker and decoder for Hello Kitty Packer
HelloKitty
2022-04-18 ⋅ AdvIntel ⋅ Vitali Kremez, Yelisey Boguslavskiy
Enter KaraKurt: Data Extortion Arm of Prolific Ransomware Group
AvosLocker BazarBackdoor BlackByte BlackCat Cobalt Strike HelloKitty Hive Karakurt
2022-03-21 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered
HelloKitty BazarBackdoor Cobalt Strike Conti FiveHands HelloKitty IcedID
2021-11-02 ⋅ SpearTip ⋅ Chris Swagler
FBI Warning: HelloKitty Ransomware Add DDoS to Extortion Arsenal
HelloKitty
2021-10-28 ⋅ FBI ⋅ FBI
CU-000154-MW: Tactics, Techniques, and Indicators of Compromise Associated with Hello Kitty/FiveHands Ransomware
HelloKitty
2021-08-24 ⋅ Palo Alto Networks Unit 42 ⋅ Doel Santos, Ruchna Nigam
Ransomware Groups to Watch: Emerging Threats
HelloKitty AvosLocker HelloKitty Hive LockBit
2021-07-17 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
HelloKitty ransomware is targeting vulnerable SonicWall devices
HelloKitty
2021-06-28 ⋅ CrowdStrike ⋅ Alexandru Ghita
New Ransomware Variant Uses Golang Packer
FiveHands HelloKitty
2021-05-31 ⋅ DataBreaches.net ⋅ Dissent
Babuk re-organizes as Payload Bin, offers its first leak
Babuk HelloKitty
2021-04-29 ⋅ FireEye ⋅ Justin Moore, Raymond Leong, Tyler McLellan
UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat
Cobalt Strike FiveHands HelloKitty
2021-03-18 ⋅ Malwarebytes ⋅ Jovi Umawing
HelloKitty: When Cyberpunk met cy-purr-crime
HelloKitty
2021-03-08 ⋅ Sentinel LABS ⋅ Jim Walter
HelloKitty Ransomware Lacks Stealth, But Still Strikes Home
HelloKitty
2021-02-10 ⋅ Cado Security ⋅ Christopher Doman
Punk Kitty Ransom - Analysing HelloKitty Ransomware Attacks
HelloKitty
2021-02-09 ⋅ Twitter (@fwosar) ⋅ Fabian Wosar
Tweet on CD PROJEKT RED targeted by HelloKitty ransomware group
HelloKitty
2020-11-13 ⋅ ID Ransomware ⋅ Andrew Ivanov
HelloKitty Ransomware
HelloKitty
Yara Rules
[TLP:WHITE] win_hellokitty_auto (20260917 | Detects win.hellokitty.)
rule win_hellokitty_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.hellokitty."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8a817cd34100 88460a 8a8174d34100 8bca 88460b 83e207 c1e903 }
            // n = 7, score = 100
            //   8a817cd34100         | mov                 al, byte ptr [ecx + 0x41d37c]
            //   88460a               | mov                 byte ptr [esi + 0xa], al
            //   8a8174d34100         | mov                 al, byte ptr [ecx + 0x41d374]
            //   8bca                 | mov                 ecx, edx
            //   88460b               | mov                 byte ptr [esi + 0xb], al
            //   83e207               | and                 edx, 7
            //   c1e903               | shr                 ecx, 3

        $sequence_1 = { 8b75fc 894df8 c1c105 8b4024 8945ac 8bc2 034dac }
            // n = 7, score = 100
            //   8b75fc               | mov                 esi, dword ptr [ebp - 4]
            //   894df8               | mov                 dword ptr [ebp - 8], ecx
            //   c1c105               | rol                 ecx, 5
            //   8b4024               | mov                 eax, dword ptr [eax + 0x24]
            //   8945ac               | mov                 dword ptr [ebp - 0x54], eax
            //   8bc2                 | mov                 eax, edx
            //   034dac               | add                 ecx, dword ptr [ebp - 0x54]

        $sequence_2 = { 895d08 33fe 895810 8bdf 897014 33da }
            // n = 6, score = 100
            //   895d08               | mov                 dword ptr [ebp + 8], ebx
            //   33fe                 | xor                 edi, esi
            //   895810               | mov                 dword ptr [eax + 0x10], ebx
            //   8bdf                 | mov                 ebx, edi
            //   897014               | mov                 dword ptr [eax + 0x14], esi
            //   33da                 | xor                 ebx, edx

        $sequence_3 = { 8955ec 0fb6d1 8b4dfc c1e908 0fb6c9 8b149560454200 }
            // n = 6, score = 100
            //   8955ec               | mov                 dword ptr [ebp - 0x14], edx
            //   0fb6d1               | movzx               edx, cl
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   c1e908               | shr                 ecx, 8
            //   0fb6c9               | movzx               ecx, cl
            //   8b149560454200       | mov                 edx, dword ptr [edx*4 + 0x424560]

        $sequence_4 = { 03f7 c1ca0d 8b7df0 33d0 0175fc 8bcb 0bcf }
            // n = 7, score = 100
            //   03f7                 | add                 esi, edi
            //   c1ca0d               | ror                 edx, 0xd
            //   8b7df0               | mov                 edi, dword ptr [ebp - 0x10]
            //   33d0                 | xor                 edx, eax
            //   0175fc               | add                 dword ptr [ebp - 4], esi
            //   8bcb                 | mov                 ecx, ebx
            //   0bcf                 | or                  ecx, edi

        $sequence_5 = { 8975f4 3306 83c604 8945dc 8945fc }
            // n = 5, score = 100
            //   8975f4               | mov                 dword ptr [ebp - 0xc], esi
            //   3306                 | xor                 eax, dword ptr [esi]
            //   83c604               | add                 esi, 4
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax
            //   8945fc               | mov                 dword ptr [ebp - 4], eax

        $sequence_6 = { 52 56 8bc8 e8???????? 50 8d4c242c e8???????? }
            // n = 7, score = 100
            //   52                   | push                edx
            //   56                   | push                esi
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     
            //   50                   | push                eax
            //   8d4c242c             | lea                 ecx, [esp + 0x2c]
            //   e8????????           |                     

        $sequence_7 = { f3ab 8d460c 50 51 8d55d8 e8???????? }
            // n = 6, score = 100
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   8d460c               | lea                 eax, [esi + 0xc]
            //   50                   | push                eax
            //   51                   | push                ecx
            //   8d55d8               | lea                 edx, [ebp - 0x28]
            //   e8????????           |                     

        $sequence_8 = { 0bf9 8b4dd8 33d0 8bc3 03fe 8b759c c1c802 }
            // n = 7, score = 100
            //   0bf9                 | or                  edi, ecx
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   33d0                 | xor                 edx, eax
            //   8bc3                 | mov                 eax, ebx
            //   03fe                 | add                 edi, esi
            //   8b759c               | mov                 esi, dword ptr [ebp - 0x64]
            //   c1c802               | ror                 eax, 2

        $sequence_9 = { 13c2 03cf 894de0 8b4df4 13c3 8945dc }
            // n = 6, score = 100
            //   13c2                 | adc                 eax, edx
            //   03cf                 | add                 ecx, edi
            //   894de0               | mov                 dword ptr [ebp - 0x20], ecx
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   13c3                 | adc                 eax, ebx
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax

    condition:
        7 of them and filesize < 319488
}
Download all Yara Rules