Overview

overview

10

Static

static

8

5954558d43...e5.exe

windows7_x64

10

5954558d43...e5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5

  • Size

    764KB

  • Sample

    210830-zjzbaqzq1x

  • MD5

    e3798c3bea835b99e994956acf3b942c

  • SHA1

    ca247833b60a6043c6361e5772e1e6acf848de5d

  • SHA256

    5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5

  • SHA512

    be4cf342680d5f7ca50ce9228ad75f6deb2e14958395b2f0f754e90f1be8af6bae79753b74263eacf85df77680900a2245135dc15a093142be612c3d255b09f5

Score
10/10
hiveransomwarespywarestealerupx

Malware Config

Targets

    • Target

      5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5

    • Size

      764KB

    • MD5

      e3798c3bea835b99e994956acf3b942c

    • SHA1

      ca247833b60a6043c6361e5772e1e6acf848de5d

    • SHA256

      5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5

    • SHA512

      be4cf342680d5f7ca50ce9228ad75f6deb2e14958395b2f0f754e90f1be8af6bae79753b74263eacf85df77680900a2245135dc15a093142be612c3d255b09f5

    Score
    10/10
    hiveransomwarespywarestealer

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks