Loading malware…
HelloXD is a double-extortion ransomware family first observed in late 2021 that targets both Windows and Linux environments. It encrypts victim files, appends a distinctive new extension, and uses victim-specific identifiers and ransom notes to direct negotiations through Tox and, in later variants, onion-based messaging services rather than a conventional leak site. The family has been associated with data theft prior to encryption, making it both an availability and extortion threat.
Code-level analysis has shown substantial overlap between HelloXD and the leaked Babuk/Babyk source code, including closely related encryption and implementation logic. Multiple Windows variants have used packing, obfuscation, and in-memory execution to hinder analysis. Observed behaviors include disabling or deleting Volume Shadow Copies to impede recovery, deleting the initial payload after execution, and changing the desktop background in some later builds. A newer sample was noted for using Windows COM interfaces in a manner similar to legitimate backup software to remove shadow copies, indicating continued development and adaptation.
Some HelloXD variants have also deployed a secondary backdoor payload identified as MicroBackdoor. That component provides persistent remote access capabilities such as command execution, file transfer, and filesystem interaction, suggesting an effort to retain access or monitor compromised environments after ransomware deployment. While one newer HelloXD sample reportedly lacked both exfiltration functionality and the MicroBackdoor component, the broader family is consistently characterized as ransomware used in double-extortion operations.
HelloXD has been attributed with moderate confidence to the threat actor known as x4k, a likely Russian-speaking operator also associated with aliases including L4ckyguy and uKn0wn. The actor has been linked to broader criminal activity involving Cobalt Strike Beacon deployment, crypter services, exploit-related activity, malware hosting, and custom tooling. Overall, HelloXD represents an actively developed ransomware family combining encryption, recovery inhibition, negotiation via privacy-focused communications, and in some cases follow-on backdoor deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Executive Summary HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Unit 42 performed an in-depth analysis of the ransomware samples, the obfuscation and execution from this ransomware family... The second sample, on the other hand, is far more obfuscated, and is executed in memory by a packer rather than a full-scale loader.
The first sample is fairly rudimentary, with minimal obfuscation and typically paired with an obfuscated loader responsible for decrypting it through the use of the WinCrypt API before injecting it into memory.
Additionally the ransomware does a ping to 1.1.1[.]1 and asks to wait a timeout of 3000 milliseconds between each reply, quickly followed with a delete command to delete the initial payload. cmd.exe /C ping 1.1.1[.]1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\admin\Desktop\xd.exe"
HelloXD is a ransomware family performing double extortion attacks... When executed, HelloXD tries to disable shadow copies to inhibit system recovery before encrypting files... the ransomware finishes by appending the file extension .hello, alongside a ransom note titled Hello.txt.
120 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family associated with double-extortion attacks; it steals victim data before encrypting systems. In this sample, it used a newer technique leveraging Windows COM libraries to delete all Volume Shadow Copies and hinder recovery.
Referenced only as a prior example of malware using Tox as a communication mechanism.
A double-extortion ransomware family first observed in late 2021 that targets Windows and Linux systems, disables shadow copies, encrypts files, appends the .hello extension, drops a Hello.txt ransom note, and directs victims to negotiate via TOX and onion-based messaging. The report notes strong code overlap with leaked Babuk/Babyk source code and describes multiple variants with differing packers and encryption routines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.