HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)

HELLOKITTY is a ransomware written in C++ that shares similar code structure and functionality with DEATHRANSOM and FIVEHANDS. HELLOKITTY has been used since at least 2020, targets have included a Polish video game developer and a Brazilian electric power company.(Citation: FireEye FiveHands April 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1
Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1
Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1
Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055)	Attack Pattern	HELLOKITTY - S0617 (5d11d418-95dd-4377-b782-23160dfa17b4)	Malware	1