Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
While Detect It Easy claims the ransomware was packed with Confuser and ConfuserEx... To be entirely accurate, however, HILDACRYPT is packed with ConfuserEx.
HILDACRYPT camouflages itself as a legitimate XAMPP installer... However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature.
To encrypt the user’s files, the ransomware uses AES-256-CBC crypto algorithm... Encrypted files get an ‘HCY!’ extension.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
HILDACRYPT is a Windows .NET ransomware family disguised as a fake XAMPP installer ('xamp.exe'). It creates a batch script to disable recovery, shadow copies, SQL services, backup software, and anti-malware tools, then encrypts files across drives using AES-256-CBC. The per-file AES key and IV are stored in the file header after being encrypted with an embedded RSA-2048 public key, and encrypted files receive the '.HCY!' extension. It drops HTML ransom notes with attacker contact emails.
Ransomware whose developer released the master private decryption keys, enabling creation of a free decryptor for potential victims. The developer claimed it was made 'for fun' and mainly as an educational project, and indicated it was likely never used on anyone.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.