hive

General

Target

9a047e0ffd51190cec150aec2c10bfcf546b75e4442d9280fb6fbfba28a7e083
Size

2.8MB
Sample

220113-ls996shcam
MD5

4cd47497f204e06035a82dbf52b39fec
SHA1

bd07c57aead84fec6fac5eaa85d6ee5fb35bd4b8
SHA256

9a047e0ffd51190cec150aec2c10bfcf546b75e4442d9280fb6fbfba28a7e083
SHA512

f44a9c987946fcbfc19264915150ec150f65fe6aebf70cc3a48b38a4bb28d080cdd685290cae0462eb925dbede38b79c959fc45fb0486a136a2681461ab313f6

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\sXhL_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: PmVLWj8fW8AP Password: 73oonMZEG4hvqq5twmp5 To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.rmvlh files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  9a047e0ffd51190cec150aec2c10bfcf546b75e4442d9280fb6fbfba28a7e083
- Size
  
  2.8MB
- MD5
  
  4cd47497f204e06035a82dbf52b39fec
- SHA1
  
  bd07c57aead84fec6fac5eaa85d6ee5fb35bd4b8
- SHA256
  
  9a047e0ffd51190cec150aec2c10bfcf546b75e4442d9280fb6fbfba28a7e083
- SHA512
  
  f44a9c987946fcbfc19264915150ec150f65fe6aebf70cc3a48b38a4bb28d080cdd685290cae0462eb925dbede38b79c959fc45fb0486a136a2681461ab313f6
Score

10^/10

hive evasion ransomware spyware stealer trojan
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2