Overview

overview

10

Static

static

8

88f7544a29...d1.exe

windows7_x64

1

88f7544a29...d1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.zip

  • Size

    762KB

  • Sample

    211116-s1b6nsbdcm

  • MD5

    2fe6685d26686c4c39592d5c106cdd0f

  • SHA1

    a6a69b2555af03af09409a9e705cf96cc6b7e5a2

  • SHA256

    011940fa7ad425f96cd82f7460a5d01503638573dd77da9873df7aecaf35e686

  • SHA512

    e9981e87fd2883f4f0ace31e5f17998e85c754099b79ea9ce023ed6239a4033243ef2d887c07067bcc0bde8efd4a68981510f1cd77d7c0b193db5234baa60e7c

Score
10/10
hiveransomwarespywarestealerupx

Malware Config

Targets

    • Target

      88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

    • Size

      764KB

    • MD5

      2f9fc82898d718f2abe99c4a6fa79e69

    • SHA1

      9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

    • SHA256

      88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

    • SHA512

      19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

    Score
    10/10
    hiveransomwarespywarestealer

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks