HildaCrypt Ransomware Targets Backup and Security Tools as Decryption Keys Emerge
Malware Intelligence · 2 sources · Updated 3mo ago · First seen Sep 14, 2019
Researchers analyzed HildaCrypt, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named xamp.exe and obfuscated with ConfuserEx. Once launched, it created a GUID-named folder under %AppData%\Roaming%, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used AES-256-CBC for file encryption, appended the .HCY! extension, and stored the AES key and IV in each file after encrypting them with an embedded RSA-2048 public key; it then dropped an HTML ransom note, HILDACRYPTReadMe.html, directing victims to contact the operator by email.
A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher GrujaRS had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and Michael Gillespie confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
