hive

General

Target

aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153
Size

1.8MB
Sample

220414-sfkx3sdbdr
MD5

0c18bc83e838deec24af20d139b411d7
SHA1

00e5e0e05a18bd01498f247145ae591a654e07f4
SHA256

aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153
SHA512

1d12ac5b2d4917c77964ad9464a334d9340d708e15c1a0ef467b95e1766ed96a9d5927e529d690c580917d6b776c9d9fedcce772f667188645d714b8445a25c7

Score

10^/10

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: abc Password: abc To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153
- Size
  
  1.8MB
- MD5
  
  0c18bc83e838deec24af20d139b411d7
- SHA1
  
  00e5e0e05a18bd01498f247145ae591a654e07f4
- SHA256
  
  aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153
- SHA512
  
  1d12ac5b2d4917c77964ad9464a334d9340d708e15c1a0ef467b95e1766ed96a9d5927e529d690c580917d6b776c9d9fedcce772f667188645d714b8445a25c7
Score

10^/10

hive ransomware spyware stealer
- Detects Rust x86 variant of Hive Ransomware
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2