Loading malware…
9 distinct techniques documented for this family, organized by ATT&CK tactic.
After adding the ‘bat’ file to this location, the ransomware then runs it with cmd.exe: cmd.exe /c \ JKfgkgj3hjgfhjka.bat \ & exit
While Detect It Easy claims the ransomware was packed with Confuser and ConfuserEx... To be entirely accurate, however, HILDACRYPT is packed with ConfuserEx.
HILDACRYPT camouflages itself as a legitimate XAMPP installer... However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature.
The script contains a long list of commands that deletes shadow copies... vssadmin Delete Shadows /all /quiet
The ransomware’s strings are encrypted when stored. Once launched, HILDACRYPT decodes them with Base64 and AES-256-CBC.
After disabling the mentioned above services and processes, the cryptolocker collects information about all running processes using the tasklist command to make sure that all the needed services were disabled.
To encrypt the user’s files, the ransomware uses AES-256-CBC crypto algorithm... Encrypted files get an ‘HCY!’ extension.
In addition to attacking popular backup and anti-malware solutions from Veeam, Sophos, Kaspersky, McAfee, and others... it also tries (unsuccessfully) to stop the Acronis Cyber Backup services.
The script contains a long list of commands that deletes shadow copies, disables any SQL server, as well as backup and anti-malware solutions.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.