hive

General

Target

16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.7z
Size

874KB
Sample

220112-x5zvradgek
MD5

45de841542f53d40ee6da66e0af6b227
SHA1

540eb9995a9ba40823a2e249f4eb515e901538f9
SHA256

d435a055b77b9cfa3281fe7219bb5b276cc685ba2f306c33a6cfe180ab232434
SHA512

9c7a0d94cb0741bc739a571056006680de06366b44419a1666e417a62593798589472c43cf6355f7ce235878c73e0e06b61393934870182e05da575f9e50a512

Score

10^/10

Malware Config

Extracted

Path

C:\JZRG_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: gnEFemaDs3pK Password: B3zwzo7oWHf5EjbHbSeV To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.iavpt files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1
- Size
  
  2.7MB
- MD5
  
  8486072a80d4cef5b18407ffa74a965d
- SHA1
  
  b3bbdd7d990092b8545c04bf6cea5572c1d1cb4c
- SHA256
  
  16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1
- SHA512
  
  dea0bc47c7b3b178e128d2349ede55d7c13cd5884ce49a178668b9e0a527f2f415eef432a5523c8c129436e37d8a7f424ce0dbebf95b89e22a9d7a1c15c083e5
Score

10^/10

hive evasion ransomware spyware stealer trojan
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2