---
title: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes
description: Nokoyawa ransomware was first discovered in February 2022, and it initially shared similarities to the Hive ransomware. As this threat has evolved, it's become more dangerous, and appears to have claimed numerous victims already.
canonical_url: https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

17 October 2023

# Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes

Nokoyawa ransomware was first discovered in February 2022, and it initially shared similarities to the Hive ransomware. As this threat has evolved, it's become more dangerous, and appears to have claimed numerous victims already.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

### Summary

*   The first variant of “Nokoyawa” ransomware is suspected to be related to the “Hive” ransomware family, but is currently identified as an autonomous threat actor.
*   The Nokoyawa ransomware version examined in this report (1.1) is written in C++ and requires a configuration file to be executed.
*   Nokoyawa contains misleading techniques to avoid analysis.
*   This version of Nokoyawa has a bilingual ransom note.

### Introduction

[](https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/)Nokoyawa is a piece of ransomware that was first discovered in February 2022, and it initially shared similarities to the Hive ransomware.

Since its first appearance, four versions of Nokoyawa have been developed. Version 1.0 and 1.1 (which are written in C/C++), and 2.0 and 2.1 (AKA “Nevada”), which are written in Rust. Versions 1.1 and 2.0 require a configuration file passed as a CLI argument to execute. The ransomware strains of versions 1.1 and 2.1 were first found at the beginning of 2023, however, all four versions of Nokoyawa are used interchangeably, up to this day.

As Nokoyawa has evolved, it’s become a more dangerous threat, and it appears that the gang has now claimed some victims. According to Nokoyawa’s leak site, the gang is already known to have compromised organizations including Tampa General Hospital, a non-profit hospital located in Florida.

Up until now, Nokoyawa’s only known method of distribution of the ransomware is via Cobalt Strike. However, it is unclear if this is still in use in recent attacks, as there is no data regarding it.

The Nokoyawa gang claims to encrypt and extract its victims’ sensitive information, as can be seen on their leak site.

### Technical details

The analyzed sample is a 32-bit architecture Portable Executable (PE), that was compiled with Borland Delphi 3.0 compiler.

![Image 1: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/5237ac59222834f084143f0afc934837.png)

Further examination of the malware reveals that Nokoyawa uses CLI as a subsystem, which implies that this is a sample of Nokoyawa version 1.1 or 2.0.

![Image 2: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/caf719e7f50bac358840ec1dc4ff30b6.png)

Given the findings that this malware sample was both compiled in Delphi 3.0 and has CLI, we can determine that we are looking at Nokoyawa version 1.1.

Examining the first code block in the debugger, we can see that the malware calls a function before performing any other actions. This function call appears suspicious — it’s unexpected for malware to perform any major functional operation regarding payload execution, because no execution-related DLL has been loaded that might support it.

![Image 3: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/bc5baf82e720962a276fd3789cdd36af.png)

### Decryption analysis

![Image 4: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/91cf12db083082e14c0c09bb1ef98ca3.png)

By analyzing the function that is being called, as seen in the image below, we see that it contains hardcoded strings that are passed to two main decryption functions. The decrypted strings turn into command line arguments and configuration file parameters. Those functions are referred to as “Secret Decryption Initialization.”

![Image 5: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/27292043047339aaa404d7582491e0eb.png)

The first hardcoded string is passed to the function as an expected argument, and another two strings are stored in registers: _edx_ and _ecx_.

![Image 6: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/e1e6fa58a45f28170efb78494cab59f3.png)

1.   First string – First part of the decryption key
2.   Second string – Second part of the decryption key
3.   Third string – “Secret”
4.   Initialized secret decryption

Upon examination of the decryption functions, it becomes apparent that the code is nearly identical, with the exception of the switch between operations when the _ebx_ and _esi_ registers are used.

![Image 7: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/edd5535012fb99dbb9d99c7f6c7a665a.png)

The malware first uses a function to determine whether "Crypt32.dll" was successfully loaded before attempting to obtain a handle to one of the functions contained within Crypt32.dll. Those functions are not yet mapped into the memory and are only loaded when called during runtime; thus, they are represented in the code by their offset inside Crypt32.dll.

![Image 8: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/ec5c410588f4913e3a6b4bed8c05ca09.png)

![Image 9: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/c7d42a992add83916a15dc64ad673d1d.png)

Nokoyawa attempts to get its process heap stub to allocate memory to write into by using the "GetProcessHeap" and "RtlAllocateHeap" functions.

![Image 10: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/0da3504d1914f82125cd6918aed56f77.png)

The ransomware utilizes the "CryptStringToBinary" function, which is located in the _Crypt32.dll_ library. This function converts a string into a binary array and writes it to the memory.

The string that is being written as a binary array is the “secret” that was prepared before the calling of the “initialize secret decryption” function.

![Image 11: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/f1a2929b57ee65844a8ff5d782e655d6.png)

The function that is being called is meant to write the passed strings into the memory. The function is called twice, once for every part of the decryption key.

![Image 12: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/5e679a2fcdb98fc26d76abb1165ec30f.png)

After Nokoyawa writes the first and second strings into the memory, it calls a function referred to as “Decrypt Secret,” which prepares the strings for the decryption of the third passed string (the “secret”).

![Image 13: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/929f84874f10fc9fe0772413aa8fe2e5.png)

In the “Decrypt Secret” function, there is a loop consisting of three blocks of code. The second block of code, which is called the “Prepare Final Key” function, is executed only once to get the final decryption key for the “secret.”

![Image 14: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/49a07aedecc71843f036498e68065c5f.png)

The first and third blocks of code execute as part of the final secret decryption step. The first block of code is used as a counter to the length of the secret’s string. The third block of code is used to run an XOR operation on every four bytes of the secret’s binary array and the respectively located four bytes of the final decryption key.

The part below is linked to the Salsa20 stream cipher, and is the method of producing the cipher's key schedule. The malware is deceptively pushing the string “expand 32-byte k” into the memory, giving the impression that the key generation is made by the Salsa20 algorithm. The true nature of the static string differs — the string is never read from memory, but is instead used as a string that is the third and last part of the full decryption key.

![Image 15: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/e9d3a631cf00e1069c126d69e33ba154.png)

The following code block stores the pushed characters to construct the full expression “expand 32-byte k.” Since the characters that are stored in the stack are four bytes each, the characters are pushed four at a time in one code block execution.

![Image 16: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/629049a294531f103170e7f0f69d4ace.png)

Every four characters are stored in the stack 16 bytes away from each other. When put together, the following expression is constructed.

![Image 17: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/37c21a05f351f8712e22a3c84f90c82d.png)

Due to moving 16 bytes in one code block execution, and since the whole expression is 16 characters long, the code block executes four times in total.

![Image 18: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/7a72b649d302a0c94ccc6df7fb026408.png)

Next, Nokoyama writes the second and first string between the memory spaces of “expand 32-byte k.”

![Image 19: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/5b60f94d07a651a11d272ca48b655fe9.png)

This is done by entering the first 16 bytes of the second part of the decryption key in the first space. Then, the first part of the decryption key — followed by zeroes (0x0) to match the 16-byte length — is entered. The third space is filled by the rest of the bytes of the second part of the decryption key.

![Image 20: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/2266d854c687c692bfbd1ab426c6c7a8.png)

This creates a 64-byte string in the memory, which is the full decryption key.

According to the analysis, Nokoyama creates a 64-byte key, which it attempts to copy to two other memory locations. Specifically, the malware copies the key to the previous 64 bytes (0x40) and 128 bytes (0x80) in memory relative to the address of the full decryption key.

![Image 21: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/f80a27ca4385ae84ce103f7832ab62d5.png)

The following code blocks set a counter for how many times the full decryption key is encrypted by the Salsa20 cipher. Two functions that are being called in the second code block are implementation of the Salsa20 algorithm.

![Image 22: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/75db6b86e7e41098c688375d8eaf0ba0.png)

The Salsa20 algorithm involves adding the values of registers _ecx_ and _ecx+0x30_.

![Image 23: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/f4dbef9931547a84112a61d138fbf18a.png)

The values that are stored in _ecx_ and _ecx+0x30_ are “expa” (_ecx_) and the second 4 bytes of the second part of the second decryption key (_ecx+0x30_). Here’s a look at the values before and after the Salsa20 code block is executed:

![Image 24: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/aa1072c6f589644e36ff477f0c269bbf.png)

Since the third part of the decryption key is being used with a different, second part of the key each time, the first four bytes of the second copy of the full key in the memory are always “expa.” The expected value of the encrypted decryption key in the memory has a different hex value.

Before and after performing the Salsa20 code block:

![Image 25: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/fc48565fba7c9c8d4208af9a61bde6cb.png)

The “Prepare Final Key” function goes over every four bytes of the encrypted copy of the full decryption key, and adds to its hex value the value of the respective four bytes of the unencrypted copy of the full key.

![Image 26: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/4f489d8f852be896b2d7d2442dd92be8.png)

The hex value that results from this operation is stored in the respective four bytes in the original full decryption key address. This results in a final decryption key that is used to decrypt the “secret.”

The figure below shows the before and after of the decryption.

![Image 27: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/a9e608a4e0520cd761421512b05c314c.png)

The code block below shows the order of the command line arguments that are passed for the malware to run.

The command line arguments:

*   --config – The configuration file the malware uses. 
*   --dir – Encrypt selected directory and sub-directories.
*   --file – Encrypt only selected file. 

![Image 28: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/2c39a4e3cf39b4a8bd663412f6b4e05c.png)

### Encryption analysis

Nokoyawa’s configuration file is built modularly, allowing the attacker to modify every aspect of the ransomware’s execution.

During the encryption stage, Nokoyawa encrypts all files in every directory of the infected host, except the directories that are excluded specifically in the configuration file.

In each directory, the ransomware encrypts all files except those with file extensions that are excluded in the configuration file.

![Image 29: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/050ca265b2d49d7ec736e7ce235e9a30.png)

File encryption is performed by encrypting the current file and having a handle for the next file in the listdir list.

![Image 30: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/b516d29bf4e720ffeb549e0aa4a51296.png)

In each encrypted directory, Nokoyawa leaves the ransom note _NOKOYAWA\_readme.txt_.

After each file is encrypted, it adds an extension provided by the configuration file. In this case, the extension is “.NOKOYAWA”.

![Image 31: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/efc21be15b921714a914159379c90a5a.png)

The ransom note’s contents may vary depending on the configuration file, but the note used in one of the examined samples contains the following:

![Image 32: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/cfe48aa41fe57ade470d91eb30fedf50.png)

## Detected by Acronis

Acronis Cyber Protect successfully detects and prevents execution of Nokoyawa ransomware.

![Image 33: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/f9ee3794d460865782b748c57cf74c1b.png)

## Conclusion

Nokoyawa ransomware has evolved greatly since its first appearance at the beginning of 2022. It currently has four different known versions. In some of these, the malware expects a configuration file, making the sample more protected.

Although the Nokoyawa gang is considered to be a relatively new actor in the cybersecurity landscape, they have already claimed victims such as Nexon Asia Pacific and Tampa General Hospital.

Victims who fail to comply with the attackers’ ransom demands risk having their files leaked on Nokoyawa's data leak site on the dark web.

Acronis Cyber Protect offers full protection against encryption by malware and other suspicious system operations, ensuring the safety of sensitive documents and information.[](https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/)[](https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/)

### IoCs

### Files

**Type**

**Indicator**

**Description**

SHA-256

3c9f4145e310f616bd5e36ca177a3f370edc13cf2d54bb87fe99972ecf3f09b4

Nokoyawa Ransomware 1.1

SHA-256

E097CDE0F76DF948F039584045ACFA6BD7EF863141560815D12C3C6E6452DCE4

Nokoyawa Ransomware 1.0

## About the authors

![Image 34: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/7d296bcf79c9f46109f9cfbae8a04774.png)

**Yuval Shoef**Yuval Shoef is an MDR analyst at Acronis, taking part in various malware research projects as well as day-to-day work on Acronis Detection and Reponse and Acronis Cyber Protect

![Image 35: Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://staticfiles.acronis.com/images/content/a961ae111f2148a3419ab09cb58a7d53.png)

**Ilia Kulmin**Ilia Kulmin is an MDR analyst at Acronis, focusing primarily on researching emerging threats and sophisticated malware, as well as daily work with Acronis Detection and Response and Acronis Cyber Protect.

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)