<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>06/13/2022 - Diary entry #530:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>Recently, a new ransomware strain was disclosed. Active since at least November 2021, HelloXD is a group that operates using the double-extortion model and it targets both Linux and Windows-based systems. After the attack, the threat actors negotiate directly
with their victims using peer-to-peer and end-to-end encryption instant message software like qTOX - commonly used among criminals on the dark web.
<div><br>
</div>
<div>HelloXD’s code suggests that it is a modified version of Babuk’s leaked source code (covered in the Daily Diary #342 in 2021). Additionally, one of its samples was observed deploying an open-source Backdoor known as MicroBackdoor to establish a foothold
into the compromised systems.</div>
<div><br>
</div>
<div>When executed, HelloXD deletes shadow copies to prevent recovering the encrypted files. Then, it deletes itself and creates a mutex containing a specific text that can be used as IOC: “With best wishes and good intentions...“. Mutex is a locking mechanism
to serialize access to a resource on the system and is used by this malware to avoid reinfecting the host. HelloXD disclosed samples were packed using a modified version of UPX, a very common packer found in both malware and trusted samples.</div>
<div><br>
</div>
<div>To encrypt data, similar to other Ransomware, HelloXD uses a combination of one asymmetric algorithm (with the public key sent along with the malware) and a symmetric algorithm (with the key generated in runtime). But instead of using the common RSA+AES
combination, HelloXD uses Elliptic-curve cryptography (ECC) for the asymmetric encryption, and HC-128 or Rabbit symmetric ciphers. After encrypting all files, it appends the files with the extension “.hello”. Then, it drops a ransom note named “Hello.txt”
with instructions to download qTOX and contact the actors. </div>
<div><br>
</div>
Reusing leaked Ransomware code is usually done by unskilled threat actors that don’t have the resources (or knowledge) to build their own, but that doesn’t seem to be the case for HelloXD. The threat actors behind HelloXD seem to have real development skills
- modifying encryption algorithms and adding their flavor to it. The ransomware operation itself seems to be in the early stages of development, with no wall of shame disclosed so far.
<br>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<br>
<span style="margin:0px; background-color:white"></span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>