hive

General

Target

windows_x64_encrypt.exe
Size

661KB
Sample

220601-t7dhraebdq
MD5

d2fab5d65d761b5efd229f0695e67011
SHA1

5480999819b359ed4f1ec284e74f8a33aa127915
SHA256

83ffbe63dd41a1a9d2d68fb1b72f6dffcf8e76ecefb8683ee47f6651f58b20a1
SHA512

dddd949221c9f1d5b425aaf4a026cec41205f78128e6b2a7aa94203c882903da87e4f5b052f36e5f9f4f91105554f86c0cf36d838c77948f438fbfda57934b3a

Score

10^/10

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: test Password: test To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  windows_x64_encrypt.exe
- Size
  
  661KB
- MD5
  
  d2fab5d65d761b5efd229f0695e67011
- SHA1
  
  5480999819b359ed4f1ec284e74f8a33aa127915
- SHA256
  
  83ffbe63dd41a1a9d2d68fb1b72f6dffcf8e76ecefb8683ee47f6651f58b20a1
- SHA512
  
  dddd949221c9f1d5b425aaf4a026cec41205f78128e6b2a7aa94203c882903da87e4f5b052f36e5f9f4f91105554f86c0cf36d838c77948f438fbfda57934b3a
Score

10^/10

hive ransomware spyware stealer
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2