NOTE: This is a year-long Research project in which I have spent a lot of time spotting and analyzing various samples of HelloKitty Ransomware since its inception.You will get a 360-View on HelloKitty 😉
INTRODUCTION
VICTIMOLOGY
HELLOKITTY DOMAINS- IN CONNECTION WITH 3 ONIONS
HELLOKITTY INTERNALS
HELLOKITTY — 2020 BATCH
CHRISTMAS 2020 BATCH — HELLOKITTY AS FIVEHANDS
HELLOKITTY — 2024 BATCH
HELLOKITTY TTPs: 2020 vs 2024
HELLOKITTY — DEPLOYED BY VARIOUS THREAT ACTORS
ATTRIBUTION: UKRAINE OR CHINA?
2025: STILL RELEVANT?
CONCLUSION
INTRODUCTION
HelloKitty Ransomware group has existed since late 2020 (October), which is forked from DeathRansom Ransomware Sample, coded in C++. In some samples, there is a strong presence of FiveHands Ransomware. It primarily targeted the Windows Environment, and later developed an encryptor for Linux ESXi samples, which was observed in July 2021.
Upon infection, CRYPTED , CRYPT or KITTY is appended as an extension to the encrypted file on the victim’s machine.
It is generally coded in Visual C++ and often uses UPX packing to compress the executable and makes it more harder for reversing.
Unlike other ransomware, HelloKitty does not drop its name on the Ransom Note. They start their Ransom Note by addressing the Victim Name on it like this:-
NOTE: On February 9, 2021, the group infected the popular Game Studio CD Projekt Red from Poland 🇵🇱.
Most of the filenames kept for HelloKitty are: “file” and “ionline.exe“.
VICTIMOLOGY
HelloKitty Group does not have a large list of Victims, unlike other groups and the group does not bother to recycle other’s data like what we find in today’s scenario.
Following is the list of Victims identified by HelloKitty Ransomware Group:-
- CD PROJEKT: POLAND 🇵🇱 February 2021
- CEMIG Powerplant — Brazil 🇧🇷 December 2020
- Healthcare Service — UK 🇬🇧 January 2021
- IT Service — France 🇫🇷 December 2020
On checking the timeline, it is found that the group has been barely active for 3 months spanning from December 2020 to February 2021 and made a notable headlines by compromising potential victims. This is one of the shortest span in Ransomware Scenario where a potential ransomware gets ghosted.
But later, we will see 2 new TOR Domains and newer versions of HelloKitty samples.
HELLOKITTY DOMAINS— IN CONNECTION WITH 3 ONIONS
Over the years (since 2020 — Present), the group has used 3 TOR Onion Domains for their Ransomware Campaign.
They are:-
decrypts3nln3tic.onion: #5
6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad.onion: #22
x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion: #4NOTE: The number denotes the samples spotted with the respective TOR Onion Domains
Among with new variants of HelloKitty (2024), some of the (new) samples also surfaced with obsolete v1 TOR domains.
The above sample was uploaded from the Netherlands 🇳🇱 initially, and spotted twice later in Ireland 🇮🇪.
NOTE: None of the HelloKitty TOR Domains are live ATTOW
HELLOKITTY INTERNALS
This section is NOT related to Reversing of the samples, however, it underlines the notable Uncommonness observed in the samples.
The below figure explains the Tools used, Encryption, Attack Vectors, Delivery, Mutexes etc (found in all the samples found till now).
Like other ransomware, HelloKitty also performs basic operations such as Querying Shadow Volumes to knock out the backups, Process Injections, WMI for Persistence and Stealth, OS Exhaustion Flood, Request Permissions such as: SE_DEBUG_PRIVILEGE and SE_LOAD_DRIVER_PRIVILEGE etc.
Here are the internals collected from various variants of HelloKitty Ransomware dating from October 2020 to December 2024.
NOTE: The above figure also draws the similarities spotted with other malware/ransomware pieces with associated functions.
Regarding Encryption, here is a detailed procedure of HelloKitty:-
NOTE: HELLOKITTY contains an embedded RSA-2048 public key.
This public key is SHA256 hashed and used as the victim ID within the ransom note. This RSA public key is also used to encrypt each file’s symmetric key.
For the symmetric key, HelloKitty generates a 32-byte seed value based on the CPU timestamp. A Salsa20 key is generated and encrypts a second 32 byte seed value. The encrypted result is XOR’d with the first seed, resulting in a 32 byte key used to AES encrypt each file.
After each file is encrypted, the original file size, magic value of DE C0 AD BA, and AES key are encrypted with the public RSA key and appended to the file. HELLOKITTY and FIVEHANDS append this additional metadata to the encrypted file, while DEATHRANSOM does not.
Lastly, it appends the four magic bytes DA DC CC AB to the end of the encrypted file.
Depending on the version, HELLOKITTY may or may not change the file extension.
Other samples of HELLOKITTY have used an embedded NTRU public key instead of RSA.
Some of the old HelloKitty Samples out there are:-
HELLOKITTY — 2020 BATCH
In this section, I refer to the samples dating from 2020. During my investigation, I found 4 samples that use the below TOR domain:-
- 6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad.onion
This Onion domain was initially seen on November 13, 2020.
Each victim gets a unique ID such as “02f6af250649555ea1b65f20fd9e815b23ba7d84829b93e6d8dbdb10f82c5af4” to negotiate with HelloKitty Group.
Here, we are going to analyze a sample that dates back to August 2020 with the filename: Hi_Kitty_2.exe (with MD5:136bd70f7aa98f52861879d7dca03cf2). This sample was coded in Visual C/C++.
Though this sample was created on 26th October 2020, it made its presence Online on 18th February 2021 by infecting (or being analyzed from) a 🇺🇸 machine.
Hence, a 4-month time frame is a decent time to make it dormant; which is a successive parameter for a Ransomware sample.
CHRISTMAS 2020 BATCH — HELLOKITTY AS FIVEHANDS
During the investigation, I found that there are a few samples which got created on 25th December 2020. It is notable to see that these samples are tagged under Five Hands Ransomware, though it belongs to HelloKitty.
All these samples were using the TOR V2 Domain decrypts3nln3tic.onion (which has been deprecated as of now) for negotiation with victims.
Some of the samples are:-
HELLOKITTY — 2024 BATCH
In 2024, HelloKitty again got resurfaced; which was initially submitted by petikvx (and got confirmation directly from him).
I have uncovered about 11 new samples for HelloKitty Ransomware in 2024 with 4 different Entry Points.
Let’s take an example:
MD5:4d854853a5fab3421e5713fd0b6fed42
In this, 2 IPs are seen in the Network Communication
- 178.79.208.1
- 87.248.202.1
Notably, these 2 IPs are present in CyberVolk Ransomware.There were few more instances where the samples had an overlap with CyberVolk Ransomware.
By checking the timeline, we can see a sudden spike in Samples in September 2024 and the entire batch of September is uploaded from China 🇨🇳. Other samples are uploaded from Argentina 🇦🇷, Romania 🇷🇴, and Netherlands 🇳🇱.
It also indicates that multiple people worked on the HelloKitty Builds at different times, hence there are minor differences in the builds.
NOTE: During Sample Analysis, I have come across multiple samples tagged as “HelloKitty” but originally belonged to Ransomware families such as Putin, Vice Society etc. Hence, do not add the IOCs that are not confident enough to your list, especially from Crowdsourced Platforms such as VT Collections or OTX Lists.
HELLOKITTY TTPs: 2020 vs 2024
Here is the ATT&CK Matrix of HelloKitty Ransomware Sample from 2020:-
While checking the 2024 HelloKitty Samples, here is the MITRE ATT&CK Framework:-
While comparing the Criticality, it is evident that the group had more concentrated on Discovering more parameters such as Query Registry, System Info Discovery and Location Discovery.
The group not only encrypts data for impact but also terminates processes using TaskKill to disable security/backup services.
Installation of Root Certificate is missing in modern samples due to the increased detection rate. By avoiding root certificate installation, ransomware can maintain a lower profile and increase its chances of success from the modern Endpoint Security Solutions.
HELLOKITTY — DEPLOYED BY VARIOUS THREAT ACTORS
It is found that various Threat Actors and Ransomware Groups make use of HelloKitty Ransomware in their infection.
According to UNIT42:-
At the start of the group’s observed operations in 2021, Vice Society affiliates used the HelloKitty Ransomware variant as a primary payload in their infection chain.
Apart from this, it is also found that HelloKitty is being used by various threat actors such as:-
- UNC2447
- Lapsus$
- Yanluowang
- ViceSociety
ATTRIBUTION: UKRAINE OR CHINA? 🇺🇦 🇨🇳
According to the FBI, HelloKitty Ransomware operators are based out in Ukraine 🇺🇦.
Though CISA had officially announced the group’s activity traced to Ukraine, we are not sure how CISA reached the conclusion of Ukraine.
However during my investigation, I found multiple evidences which points to CHINA 🇨🇳.
ARTIFACT #1
While checking the internal files, a strong presence of the Chinese language is found. Here is the proof for the same:-
From the above, it is found that there is a strong influence of QQ, SkyCN on their “Files Deleted” section.
Though the group is being operated from Ukraine (found by CISA), there is a possibility that the group had used Ukrainian infrastructure to shift the blame.
Also, the presence of Chinese Entities such as QQ, SkyCN, etc and Mandrian Characters in the filenames points out CHINA.
NOTE: There is also a possibility that the above said artifacts could be doctored to make the presence of China.
ARTIFACT #2
It is also notable that the group had not listed a single Chinese company on their hacked victims.
ARTIFACT #3
Another indicator (MD5:8e4a887acab5f9475c5fa9a26fb9e720) which points out to China is the C2 Server found in another HelloKitty Sample:-
The group had set C2 Communication Channel to Cloudflare, Microsoft, Amazon and Google Cloud. But among them, one communication channel was chosen to CHINANET.
NOTE: This same ASN was abused by the Chinese APT Group Evasive Panda.
ARTIFACT #4
HelloKitty is the name of the anime character which is more popular and influenced in Asian Regions such as China.
ARTIFACT #5
Most of the latest Samples of HelloKitty (2024 Batch) are initially uploaded to VirusTotal from China.
Following is an example of the above-discussed artifact:-
This signifies that the threat actors are heavily concentrated in China rather than Ukraine.
2025: STILL RELEVANT?
While pivoting the hunt of 2024 sample, came across a sample (MD5:a831d838a924ea135c3e0f315f73fcd3) which is similar to the previous version, however there is no proper Onion Links present in the file.
Another factor to attribute it to HelloKitty is: This new sample also got uploaded from China like older versions.
Upon analyzing the code-base, it is found that the sample has a 5% match with RingQ Malware and rest of the codes are unique.
Hence, it could be possible that the group had revised their builds and in-process of making of new Onions as the older ones are no longer exists.
CONCLUSION
As of now, there are no active HelloKitty DLS found on the Dark Web. However, with the presence of new ransomware sample out in the wild, it can be assumed that the group would come alive by launching a new website and newer variants effectively.
If you want a complete list of IOCs, you can find it here!
NOTE: The article is purely an Individual Research that belongs to THE RAVEN FILE and is not subjected to be used/published anywhere without the Author’s consent.
Follow me on X/Twitter for interesting DarkWeb/InfoSec Short findings! 😉
Leave a Reply