YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2

Detects HelloKitty Ransomware samples from UNC2447 campaign

APT / threat actorHelloKittySignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2021-05-01
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects HelloKitty Ransomware samples from UNC2447 campaign

Associated malware family: HelloKitty.

Targets: Windows PE.

It defines 7 patterns (4 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-unc2447-mal-ransom-hellokitty-may21-2.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
{
	meta:
		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
		date = "2021-05-01"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L74-L99"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
		hash = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
		hash = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
		hash = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
		logic_hash = "1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
		$s1 = "HelloKittyMutex" wide
		$s2 = "%s\\read_me_lkd.txt" wide fullword
		$s3 = "/C ping 127.0.0.1 & del %s" wide fullword
		$s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
		$sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) or 2 of them
}

Strings (7 patterns)

Identifier	Type	Value	Modifiers
$xop1	hex	{ 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
$s1	text	"HelloKittyMutex"	wide
$s2	text	"%s\\read_me_lkd.txt"	wide fullword
$s3	text	"/C ping 127.0.0.1 & del %s"	wide fullword
$s4	text	"(%d) [%d] %s: STOP DOUBLE PROCESS RUN"	ascii fullword
$sop1	hex	{ 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
$sop2	hex	{ 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }

Condition

uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) or 2 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 600KB (a cheap guard that skips large files).
At least 1 patterns in ( $x* ) must match.
At least 2 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768
3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9
501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 82aaabc6-102a-512e-8c2a-4d6fda864c68

Tags:FILE

SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
MALPEDIA_Win_Hellokitty_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
DITEKSHEN_MALWARE_Linux_Hellokitty
MalwareditekSHen detection· ditekSHen· 2020-11-06
TRELLIX_ARC_Ransom_Linux_Hellokitty_0721
MalwareTrellix Advanced Research Center· Christiaan @ ATR· 2021-07-19
ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-14
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25

More HelloKitty rules