hive

General

Target

cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.7z
Size

837KB
Sample

220112-zlnz9adhf2
MD5

c1978cde7aefad43f70e6e52041bfd9d
SHA1

b531db00285e5e78167659dccbe1ed38bf3472c0
SHA256

d1b1f52ea8a58a52734e8e5a87838cbc1b0cdc277194a5390912127b1f1a208d
SHA512

86bc16005c613c95fbb67c984a0c4e1ab5bd75d165a120b972f1400f0bf2b95f40ec2ed99f881eab0ab7c01e8c068dc7e721cf1b509eb54abe2ab3e829a11a8e

Score

10^/10

Malware Config

Extracted

Path

C:\vyS2_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: BKQS2jdASFeQ Password: WNTWw95r5F1rqwJe66bj To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.8zvpm files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf
- Size
  
  2.6MB
- MD5
  
  47f540350b1d360403225d146cc7fbb8
- SHA1
  
  43ad25b99cb47c7367b1703315402bb9e4970590
- SHA256
  
  cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf
- SHA512
  
  91387685946beb65cddbc62b19102a1135511563bd84f24cacc402a1e5a1afb750887fa9d50e7120acd23ae27af53669a45fc48363c000b7f2ffb777036019ce
Score

10^/10

hive evasion ransomware spyware stealer trojan
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2