YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1

Detect HelloKitty ransomware

What this rule detects

Detect HelloKitty ransomware

Associated malware family: HelloKitty.

Targets: Linux ELF.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3e83f07a-0ee7-5381-9aba-2606c01b9d91

tlp	White
adversary	RAAS

Tags:FILE

MALPEDIA_Win_Hellokitty_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
DITEKSHEN_MALWARE_Linux_Hellokitty
MalwareditekSHen detection· ditekSHen· 2020-11-06
TRELLIX_ARC_Ransom_Linux_Hellokitty_0721
MalwareTrellix Advanced Research Center· Christiaan @ ATR· 2021-07-19
SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-09-14
ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-30