From 56a53433f0aae5e9c26e1d8271e9114ba3da85dc Mon Sep 17 00:00:00 2001
From: Delta-Sierra <deborah.servili@gmail.com>
Date: Fri, 8 Jul 2022 12:05:31 +0200
Subject: [PATCH] add HelloXD ransomware

---
 clusters/ransomware.json | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index bf67d65..c39e63c 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -24535,7 +24535,27 @@
       },
       "uuid": "bb6d933f-7b6d-4694-853d-1ca400f6bd8f",
       "value": "Rook"
+    },
+    {
+      "description": "HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021. During our research we observed multiple variants impacting Windows and Linux systems. Unlike other ransomware groups, this ransomware family doesn’t have an active leak site; instead it prefers to direct the impacted victim to negotiations through TOX chat and onion-based messenger instances.",
+      "meta": {
+        "date": "Nov. 30, 2021",
+        "extensions": [
+          "hello"
+        ],
+        "ransomnotes-filenames": [
+          "Hello.txt"
+        ],
+        "ransomnotes-refs": [
+          "https://unit42.paloaltonetworks.com/wp-content/uploads/2022/06/image13.png"
+        ],
+        "refs": [
+          "https://unit42.paloaltonetworks.com/helloxd-ransomware/"
+        ]
+      },
+      "uuid": "5617e6fa-4e6a-4011-9385-6b1165786563",
+      "value": "HelloXD"
     }
   ],
-  "version": 102
+  "version": 103
 }